We need to improve a system that delivers software updates (firmware/software files) to a Bluetooth device through a "companion" application installed on customers smartphones (ios/android).
The update process is implemented through calls to a REST API server (ASP.net, TLS 1.2) and being "userless" (but with different apps) we used OAuth2 with "client_credentials" flow, until now.
We used the "client_id" and "client_secret" couple to identify the caller application and then inject some claims into the bearer token, useful for example, to give different firmware to different applications. At the same time we used this system to prevent unauthorized API requests.
It works, but i never loved this system completely for various reasons, for example:
- Without users, the token server doesn't create only overhead?
- Storing client id and secret (in clear text) into mobile apps is secure?
I've read of API keys, but as this post says are not enough.
I think that we're "stretching" OAuth2 purposes to our needs, there are better ways to manage this?