title: OAuth2 password grant and Basic Authentication
body: <p>I'm developing a solution that has: an Authorization Server (AS), a Resource Server and two clients. The two clients are: a web app with Angular 2 and a mobile app with Angular 2 + Ionic 2. I have started to develop the Authorization Server following this sample <a href="https://github.com/Baeldung/spring-security-oauth" rel="nofollow noreferrer">https://github.com/Baeldung/spring-security-oauth</a></p>
  
  <p>For both the clients, I have decided to use the "Password Code Grant" because the client are trusted by the AS. </p>
  
  <p>But now I have a problem storing the "client secret code" on the apps. Because the API (.../oauth/token) is secured by Basic Authentication so every time that I ask a token to the AS I need to send something like that:</p>
  
  <pre><code>curl.exe -v -u client_id:client_secret http://localhost:8080/backend/oauth/token -d grant_type=password -d client_id=client_id -d username=admin -d password=admin
  </code></pre>
  
  <p>So, the questions are:</p>
  
  <ol>
  <li>Where I can store safely the client secret code on the apps?</li>
  <li>Is it safe to remove the Basic Authentication from the oauth API?</li>
  <li>Have I use another code grant type?</li>
  </ol>
  
  <p>Thank you,
  Paolo</p>