title: authentication using Doorkeeper from client-side application without transmitting secrets
body: <p>I'm trying to use Doorkeeper in a Ruby on Rails API app for authentication. From a client-side AngularJS app, I want to get an access token. Currently, this involves a GET request to /oauth/authorize, which gives me a code, then I POST that code along with a client_id and a secret to /oauth/token. I don't want to have to send the client ID and secret from my client-side app, since they're stored in plain-text in a JavaScript file. I would like to follow <a href="https://developers.google.com/accounts/docs/OAuth2UserAgent" rel="nofollow">this flow</a> where <code>response_type</code> is <code>token</code>, not <code>code</code>, but I can't figure out how to do that with Doorkeeper. <a href="https://github.com/applicake/doorkeeper/wiki#flows" rel="nofollow">Their wiki</a> examples all seem to involve POSTing the client ID and secret to /oauth/token.</p>
  
  <p>Is Doorkeeper the right gem for this? How can I do Google OAuth2 from a client-side app, where no secrets are passed from client-side to the server?</p>
  
  <p><strong>Edit:</strong> looks like what I want is Implicit Grant, which <a href="https://github.com/applicake/doorkeeper/wiki/Supported-Features" rel="nofollow">Doorkeeper supports</a>. Now I just have to find out how to do that in my Rails app...</p>