Register the full callback
06Record a native app’s client type and exact redirect URI, including its path.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 8.4 ↗
RFC 8252 · § 8.4EXAMPLE
3 / 3
03
Reject an unregistered callback.
The loopback-port exception is specific, not a general wildcard permission.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
A shared application secret is not an identity proof.
- Except for mechanisms provisioning per-instance secrets, native apps MUST be registered as public clients.
- Servers MUST exactly match the registered redirect, except for the loopback port.
- A secret embedded in all app copies MUST NOT be accepted as proof of client identity (§ 8.5).
A client_id identifies a registration. It is not a secret or an assurance that this app installation is authentic.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
Privacy