---
id: 7453
title: "OAuth 2.0 Client Credentials Misuse in Public Apps"
source_domain: blog.sentry.security
source_url: "https://blog.sentry.security/oauth-2-0-client-credentials-misuse-in-public-apps/"
published_at: "2025-06-19T13:35:25Z"
tags: ["appsec", "mobile-security", "authentication", "oauth", "client-credentials", "pkce"]
phying_url: "https://phying.com/item/7453"
lang: en
---

# OAuth 2.0 Client Credentials Misuse in Public Apps

## Summary

Why the OAuth 2.0 client credentials grant is unsafe for public clients: secrets embedded in SPAs and mobile apps are easily extractable, enabling app impersonation; use Authorization Code with PKCE.

## Intelligence Metadata

- **Sources:** blog.sentry.security
- **Published:** 2025-06-19T13:35:25Z
- **Original:** https://blog.sentry.security/oauth-2-0-client-credentials-misuse-in-public-apps/
- **Phying News:** https://phying.com/item/7453