# Is it safe to use the client secret in a public mobile app?

**URL:** <https://forum.keycloak.org/t/is-it-safe-to-use-the-client-secret-in-a-public-mobile-app/12349>\
**Category:** Getting advice\
**Created:** [November 29, 2021, 3:32pm UTC](https://forum.keycloak.org/t/is-it-safe-to-use-the-client-secret-in-a-public-mobile-app/12349 "2021-11-29T15:32:31Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![dasniko](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/dasniko/32/2969_2.png) [@dasniko](https://forum.keycloak.org/u/dasniko)\
**Post date:** [November 29, 2021, 4:29pm UTC](https://forum.keycloak.org/t/is-it-safe-to-use-the-client-secret-in-a-public-mobile-app/12349/2 "2021-11-29T16:29:28Z")

</div>

No, it is not safe.  
See also this thread: [Custom Login Page with social login (not the one from Keycloak)](http://forum.keycloak.org/t/custom-login-page-with-social-login-not-the-one-from-keycloak/12166) (Ignore the parts with „social login“, there‘s a lot of stuff about why it is important to use the KC login pages)  
and this one: [The final word on custom login and signup pages](http://forum.keycloak.org/t/the-final-word-on-custom-login-and-signup-pages/11433)

And…. It‘s not the Keycloak REST API - it‘s the Keycloak **ADMIN** REST API.  
It‘s meant for administering and management purposes. Not for handling user auths.

---

_[View the full topic](https://forum.keycloak.org/t/is-it-safe-to-use-the-client-secret-in-a-public-mobile-app/12349)._