title: OAuth 2.0 -Correct way to do login to for mobile app & website
body: <p>I'm building an OAuth 2.0 server for a mobile (native) application and website using IdentityServer. I wondering about the correct flow that I should use in the mobile application and the website.</p>
  
  <p>As far as I know the "implicit" flow is pretty much what I'm getting when registering as a developer for external API (such as Facebook) and when a user logs in to my website using his Facebook account he is referred to a Facebook login page that directs him with the token back to my website. This seems secure to me since the auth server refers the user to a callback url (at least for websites).</p>
  
  <p>What I implemented so far is the "Resource Owner" flow, which validates user credentials against the server with <code>client_id</code> and it's password. The problem as I see it is that the client_id and password are stored on the app (and can be reversed engineered) or on the website javascript code.</p>
  
  <p>I read on this <a href="https://stackoverflow.com/questions/17427707/whats-the-right-oauth-2-0-flow-for-a-mobile-app">post</a> (<a href="https://stackoverflow.com/questions/17427707/whats-the-right-oauth-2-0-flow-for-a-mobile-app">What&#39;s the right OAuth 2.0 flow for a mobile app</a>) that it's better to create on my API a method for logging in, and my API will communicate against the auth server (and so the client_id and password will only be stored on it).</p>
  
  <p>I'm wondering about how companies like Facebook or Google do that. They have their own login on the website, and they give API access to third party developers - what prevents developers making some authentication to their users against the Facebook login and using their APIs without limitations?</p>
  
  <ol>
  <li>What is the correct method of working? Implicit? RO?</li>
  <li>After user loges in to the website or app - how should he be remembered as logged in? Do I save the refresh token on the app/website side?</li>
  </ol>