title: REST Api authentication - exchange private key
body: <p>I'm adding rest API for mobile application into my existing grails web app. Since I'm having hard time with integrating OAuth2 provider into my application, I'm going to implement my own HMAC mechanism.</p>
  
  <p>HMAC uses secret key and what I want is, that each user of application has it's own secret key. Now the thing is how do I transfer secret in a safe manner between API and mobile device initially.</p>
  
  <p>Of course all communication will be through t SSL. But is it safe to send client secret from server to mobile client when connecting for the first time over the wire? </p>
  
  <p>Or I should use one secret and store it with mobile client, which could be easily reverse-engineered?</p>
  
  <p>Or maybe there are other and better ways to do it?</p>