title: OAuth flow for mobile application to communicate with Rest API secured by OAuth
body: <p>I've faced an interesting issue IMHO with OAuth and mobile application. I've found few similar questions on SO already, but have not found any relevant answer I'm afraid.</p>
  
  <p>The application consist of the following:</p>
  
  <ul>
  <li>Rest API secured by OAuth</li>
  <li>Android mobile application (aka trusted client / official app) that consumes the API.</li>
  </ul>
  
  <p>There are three ways for user to create an account:</p>
  
  <ul>
  <li>email / password combination</li>
  <li>Google account</li>
  <li>Facebook account</li>
  </ul>
  
  <p>There are two main problems /I suppose both are connected with each other/:</p>
  
  <ol>
  <li>What OAuth grant type should be used?</li>
  <li>How to deal with 3rd party user registration?</li>
  </ol>
  
  <p><strong>About issue #1</strong><br>
  I was thinking about using the <strong>Resource Owner Password</strong> grant /although I've found a bit different opinions about using it in native applications/ or the <strong>Client Credentials</strong> grant type. While dealing with Resource Owner Password grant type I can see an issue with the accounts created via Facebook or Google as they have no password.</p>
  
  <p><strong>About issue #2</strong><br>
  Which party should be responsible for handling Facebook/Google registration? Backend or the mobile application? As in the current scenario there's no website, I presume the mobile app should be the responsible party.</p>
  
  <p>Second problem regarding the external accounts: how do deal with them regarding the API secured by OAuth?</p>
  
  <p>I appreciate any suggestion!</p>