3 ms·
I'd actually add that implicit should never be used for mobile app unless you have no backend whatsoever.
by rdegges 8y ago
I'd actually add that implicit should never be used for mobile app unless you have no backend whatsoever.
- UncleMeat 8y agoEven then you should still use authz with pkce. At the very least nobody else should be able to get your access token. For some workflows this is all the guarantee you need.