The OAuth2 spec seems to consider native (Android & iOS) apps as "public clients", ultimately meaning that they can't use the "client credentials" flow. That being said, how does one go about requiring authentication on endpoints that expose client-owned (as opposed to user-owned) resources?
In my scenario I'm developing a REST API that exposes a few endpoints that do not need user authentication but which I'd prefer not to leave "open" (i.e., I'd like to require some form of authentication to prevent abuse). Presently I'm using the "client credentials" flow with an empty password, but I feel this is a violation of the protocol. Am I doing things wrong?