title: Slack client secret for OAuth in mobile application
body: <p>There seems to be an inconsistency in the Slack API docs in that the OAuth flow requires a client_secret be provided as part of the exchange of the code for the OAuth token as documented at <a href="https://api.slack.com/methods/oauth.access" rel="nofollow noreferrer">https://api.slack.com/methods/oauth.access</a></p>
  
  <p>However the client secret then needs to be embedded into the mobile app which goes against Slack's recommendations at <a href="https://api.slack.com/docs/oauth-safety" rel="nofollow noreferrer">https://api.slack.com/docs/oauth-safety</a> which states:</p>
  
  <p><em>Your Client Secret should be treated delicately. It is how you securely identify your application's rights and identity when exchanging tokens with Slack. Do not distribute client secrets in email, distributed native applications, client-side javascript, or public code repositories.</em></p>
  
  <p>Are there any best practices available in terms of how to manage this discrepancy where the client secret seems to be required for auth but at the same time should not be embedded into the mobile app?</p>