title: What OpenID Connect authorization flow to authenticate mobile app users?
body: <p>I am building a cross-platform mobile app that interacts with a RESTful API, and I want to use OpenID Connect to authenticate my users. I will be building my own OpenID Connect provider server.</p>
  
  <p>OpenID.net <a href="http://openid.net/connect/faq/" rel="noreferrer">claims</a> that:</p>
  
  <blockquote>
    <p>OpenID Connect allows for clients of all types, including browser-based JavaScript and native mobile apps, to launch sign-in flows and receive verifiable assertions about the identity of signed-in users.</p>
  </blockquote>
  
  <p>However, I can't find any documentation explaining how to actually authenticate for a mobile app client.</p>
  
  <p><a href="https://stackoverflow.com/a/24050911">This StackExchange answer</a> makes it clear that OpenID Connect does not support the "resource owner password-based grant" flow or the "client credentials" flow.</p>
  
  <p>That just leaves the "authorization code" flow (normally used by server-side apps) and the "implicit grant" flow (normally used by client-side apps). Both of these seem to rely on redirecting the user to the provider's authorisation endpoint, and having the provider redirect back to the client URL. I don't see how this can apply to a mobile app.</p>
  
  <p>Can anyone explain to me (or even better, point me at a tutorial or some example code) which explains how to do this?</p>
  
  <h2>Update</h2>
  
  <p>To clarify: OpenID Connect relies on the client redirecting the user to the Authorization Endpoint, and then the provider <strong>redirecting the user back</strong> to the client. In the case where the client isn't a web app, how can this work?</p>