This describes the flow for a "trusted client", which is not the correct flow to use for securing this scenario. Instead, the "untrusted client" flow looks like

This describes the flow for a "trusted client", which is not the correct flow to use for securing this scenario. Instead, the "untrusted client" flow looks like this: 1) MyLittleApp wants OAuth access to BankOfMars 2) MyLittleApp bundles BankOfMars SDK into MyLittleApp 3) MyLittleApp registers itself with BankOfMars, which then has sole discretion over whether to allow it to access data hosted by BankOfMars. 5) If approved by BankOfMars, MyLittleApp can now request oauth access to a user's data with the BankOfMars SDK. 6) SDK opens WebView for user to approve MyLittleApp's request to access user's data hosted by BankOfMars. User may reject the application's request. 7) If the user approves the application's request, the user is then prompted for authentication. This can be in the form of a username/password, but may also include two-factor authentication or whatever BankOfMars deems necessary for security. 8) Should BankOfMars or the user choose to do so, either can revoke the right of MyLittleApp to access BankOfMars data. Now, with this said, this is actually one of Eran Hammer's criticisms of OAuth2: It's hard to get all of these pieces just right! Good security should be easier.