Let's imagine the following:
- I've developed a mobile app using Xamarin (iOS/Android compatible)
- I want it to support OAuth2 + OpenID connect's authorization code flow with PKCE, so that the user's credentials are never stored on the device, but rather an access token is. The token grants access to an API used to make the whole mobile app function, meaning the mobile app is simply a front-end interface/UI.
- Is my mobile app considered the "client application", or the "Resource owner"?
The third step makes it so hard for me to grasp this. If it's considered client application, how will following through the whole code flow, protect us from anything, as most of the things will be visible (Mobile apps are public clients, there is no back-channel)
If it's considered resource owner, then does that mean I'd have to whip out an entire dedicated back-end, separate from my API, separate from my Authorization Server, and just specific for the mobile app (it will be the "Client application")?
If someone could shine some light on this, please let me know. I know the title is not very correct, if someone could edit it to better fit this question, I'd be very thankful.