I'm designing an API server and client pair. Typically, I want the client to be in a WordPress plugin. I'd like to use OAuth or something similar to secure the requests. However, as you know, OAuth depends on secrecy of the client credentials and especially the client's secret. However, WordPress is open-source, so I cannot store the client's credentials in the code.
So, my general question: what are the options to secure such a system, in which you can't store the client's credentials because the client's code is open-source?