title: OAuth 2.0 for desktop and mobile applications
body: <p>I'm doing research on OAuth 2.0 protocol.</p>
  
  <p>I came stuck in the problem of generating bearer tokens for desktop/mobile applications that don't run on a web server.</p>
  
  <p>The OAuth 2.0 protocol flow is clear to me for web applications. Suppose <code>myapp.com</code> wants to access <code>protectedresource.com</code> on behalf of user Alice, then Alice gets redirected to <code>https://protectedresource.com/oauth?redirect_uri=https://myapp.com/oauth&amp;[...]</code> so the resource manager, after obtaining consent, redirects Alice's browser to a page that will collect the authorization code and use it to obtain the bearer token.</p>
  
  <p>This works fine and secure because <code>protectedresource.com</code> recognizes <code>myapp.com</code> domain and releases the bearer token only to requests coming from <code>myapp.com</code></p>
  
  <p>If I'm running a desktop application, even with support of a browser (ie embed an HTML viewer in a Windows Form or something like that) <strong>where am I supposed to redirect Alice after consent??</strong></p>
  
  <p>Who collects the authorization code? How does the control flow change?</p>
  
  <p>Does anybody have examples of OAuth 2.0 implementations running on desktop or Android?</p>