title: Secure Google OAuth2 Authorization Code Grant on mobile
body: <p>I now researched quite some time to understand OAuth 1.0a, OAuth 2.0 and OpenID Connect. I read their RFCs/Specs and still have one question regarding Google and their Authorization Code Grant on mobile.</p>
  
  <p>OAuth 2.0 states in chapter 4.1.3:</p>
  
  <blockquote>
    <p>The authorization server MUST require client authentication for confidential clients [...]</p>
  </blockquote>
  
  <p><strong>My Question:</strong>
  How can Google ensure it's client authentication for a mobile client?</p>
  
  <p>Thanks,
  Dominik</p>