# Is it safe to use the client secret in a public mobile app? **URL:** \ **Category:** Getting advice\ **Created:** [November 29, 2021, 3:32pm UTC](https://forum.keycloak.org/t/is-it-safe-to-use-the-client-secret-in-a-public-mobile-app/12349 "2021-11-29T15:32:31Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![PockoJambo](https://avatars.discourse-cdn.com/v4/letter/p/ac91a4/32.png) [@PockoJambo](https://forum.keycloak.org/u/PockoJambo)\ **Post date:** [November 29, 2021, 3:32pm UTC](https://forum.keycloak.org/t/is-it-safe-to-use-the-client-secret-in-a-public-mobile-app/12349/1 "2021-11-29T15:32:31Z")
Hello everyone ! I’m currently trying to register / login from my mobile app. Since I don’t want to use the default keycloak webpages for these purposes, I found out that I can use the REST API (e.g. [Keycloak REST API: Create a New User - Apps Developer Blog](https://www.appsdeveloperblog.com/keycloak-rest-api-create-a-new-user/)) . Next to the blog I found this interesting video: [Keycloak login Android using API - YouTube](https://www.youtube.com/watch?v=DBf-XwYnRD8&ab_channel=AndrejKijonok) What he’s doing there is to store the client\_secret in its app and proceed with it further. Now I’m asking myself, is it really _ **safe** _ to use the **client\_secret** in a public app ? Could it be a target for attacks ? And if yes what would your advice be to implement login register event natively on my app ? Thanks ! ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [November 29, 2021, 4:29pm UTC](https://forum.keycloak.org/t/is-it-safe-to-use-the-client-secret-in-a-public-mobile-app/12349/2 "2021-11-29T16:29:28Z")
No, it is not safe. See also this thread: [Custom Login Page with social login (not the one from Keycloak)](http://forum.keycloak.org/t/custom-login-page-with-social-login-not-the-one-from-keycloak/12166) (Ignore the parts with „social login“, there‘s a lot of stuff about why it is important to use the KC login pages) and this one: [The final word on custom login and signup pages](http://forum.keycloak.org/t/the-final-word-on-custom-login-and-signup-pages/11433) And…. It‘s not the Keycloak REST API - it‘s the Keycloak **ADMIN** REST API. It‘s meant for administering and management purposes. Not for handling user auths. ---
**Author:** ![PockoJambo](https://avatars.discourse-cdn.com/v4/letter/p/ac91a4/32.png) [@PockoJambo](https://forum.keycloak.org/u/PockoJambo)\ **Post date:** [November 30, 2021, 11:13pm UTC](https://forum.keycloak.org/t/is-it-safe-to-use-the-client-secret-in-a-public-mobile-app/12349/3 "2021-11-30T23:13:32Z")
Very sad that it isn’t that easily possible 😕 How about using my backend as a middle man ? Maybe a flow like this: 1.) App user registers through a backend call (POST /users/XYZ) with username and password in request body with a TLS encrypted connection 2.) Backend (which has the client secret since it is trusted) creates the user via the mentioned Keycloak Admin REST API and returns the token to the client. 3.) Every incoming request of the app user includes the token. In that case I wouldn’t expose the client secret. Would that be a possible alternative ? PS: Thank you for your help ! ---
**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\ **Post date:** [December 1, 2021, 7:06am UTC](https://forum.keycloak.org/t/is-it-safe-to-use-the-client-secret-in-a-public-mobile-app/12349/4 "2021-12-01T07:06:03Z")
Then you have a man in the middle scenario, which you also don’t want to (must not) enforce. > **[Mobile and Native Apps - OAuth 2.0 Simplified](https://www.oauth.com/oauth2-servers/mobile-and-native-apps/)** > > Like single-page apps, mobile apps also cannot maintain the confidentiality of a client secret. Because of this, mobile apps must also use an OAuth flow ---
**Author:** ![VisheshIrasus](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/visheshirasus/32/9977_2.png) [@VisheshIrasus](https://forum.keycloak.org/u/VisheshIrasus)\ **Post date:** [March 11, 2024, 9:59am UTC](https://forum.keycloak.org/t/is-it-safe-to-use-the-client-secret-in-a-public-mobile-app/12349/5 "2024-03-11T09:59:31Z")
Alternatively use the auth code received by the frontend in query param after login and send that to backend, and send the tokens to frontend then from backend. ---
**Author:** ![embesozzi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/embesozzi/32/12390_2.png) [@embesozzi](https://forum.keycloak.org/u/embesozzi)\ **Post date:** [March 11, 2024, 12:03pm UTC](https://forum.keycloak.org/t/is-it-safe-to-use-the-client-secret-in-a-public-mobile-app/12349/6 "2024-03-11T12:03:04Z")
Or, just follow the standards and BCPs, such as OAuth 2.0 for Browser-Based Apps [1]. They usually are right 😄 [1] [draft-ietf-oauth-browser-based-apps-17](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-browser-based-apps-17)