Quote:
native application
A native application is a public client installed and executed on
the device used by the resource owner. Protocol data and
credentials are accessible to the resource owner. It is assumed
that any client authentication credentials included in the
application can be extracted. On the other hand, dynamically
issued credentials such as access tokens or refresh tokens can
receive an acceptable level of protection. At a minimum, these
credentials are protected from hostile servers with which the
application may interact. On some platforms, these credentials
might be protected from other applications residing on the same
device.
In my case the Client is an Android app. As you know it could be harmed by rooting that makes you access everything on the phone, including keys used to crypt/sign anything. I've found a solution for my needs (crypt files and communications) but I need to be trusted by the whole protocol (both Authorization and Resource Server) in some way because the key to crypt files is stored on the server and "downloaded" only to crypt/decrypt.