What is client ID and client secret in API?
At registration the client application is assigned a client ID and a client secret (password) by the authorization server. The client ID and secret is unique to the client application on that authorization server. This redirect URI is used when a resource owner grants authorization to the client application.
What is a client secret in OAuth?
Client Secret (OAuth 2.0 client_secret) is a secret used by the OAuth Client to Authenticate to the Authorization Server. The Client Secret is a secret known only to the OAuth Client and the Authorization Server. Client Secret must be sufficiently random to not be guessable.
What is the OAuth client secret?
How does authentication work in a REST API?
It returns a token which you can then send as a proof of authenticity to your API. The important difference with this approach is that though it would be possible to disable the authenticity check on the client, if you did so you would not get the authentication token you need to verify your app with the server.
Do you have to embed a secret in a REST API?
For a user, that might be a username and a password. For a piece of software where there is no user you might embed a secret. The problem with these approaches is that you have to place some trust in the client.
Do you have to be logged in to use the API?
Update: The user can perform read-only actions, which do not require the user to be logged in, but they can also perform write actions, which do require the user to be logged in (Authentication by Access Token). In both cases I want the API to respond to requests coming only from trusted mobile applications.
How to safeguard a REST API for only trusted mobile?
For most use cases simply having a single valid certificate and/or token is more than enough. If it involves doing anything hard like decompiling your app then even most hackers wont bother unless you provide some very valuable data. But hey, wheres the fun in that answer?