We're currently in the process of implementing OAuth2 to secure our new API and not sure how to securely provide required functionality. We need to allow the following from a mobile device:

> 
> Immediately after downloading the app the user is able to take a picture and submit it without having to first log in.
> 
> 
> 

While we want to allow anonymous user access, where a user does not need to log in or register to use certain functionality, we do not want to allow unauthenticated access to the API. This would normally be accomplished using the [client credentials authorization flow](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-22#section-4.4) to obtain and app access token, however this requires knowing the client secret. From what I've read, a mobile device is not considered a trusted client and should not contain the client secret, and hence should not be able to generate an app access token on its own.

We've come up with a few options to accomplish this requirement, but would like some input on them:

1. Embed the client secret in the app. Doesn't seem ideal from a security standpoint, but maybe we're missing an obvious way to secure it? We're targeting at least iOS and Android.
2. Generate an app access token offline and embed that in the app. Still not very secure, but at least the secret isn't exposed.
3. Allow access to certain functionality using only the client ID instead of an access token. This may be the simplest, but it introduces an inconsistency and requires multiple ways of authenticating the client.
4. Build and use a companion web app to generate app access tokens for the mobile app. On the surface seems like a winner, but now you have to secure access to the companion app!

How would you securely authenticate access to an API using OAuth2 from a mobile device without requiring the user to first log in?