When using Coinbase iOS SDK on mobile side and Python SDK on the backend side, looks like by design one should put client_secret on the mobile side to be able to exchange temporary code with access_token during OAUTH.
Instead of being forced to store client_secret on mobile side, we would like to send temporary code to our backend which can than exchange this code with access_token/refresh_token. This way client_secret will be stored only on our backend.
For this we need Coinbase Python SDK to provide exchange_code_with_token method which will implement the below call.
curl https://api.coinbase.com/oauth/token \
-X POST \
-d 'grant_type=authorization_code&code=4c666b5c0c0d9d3140f2e0776cbe245f3143011d82b7a2c2a590cc7e20b79ae8&client_id=1532c63424622b6e9c4654e7f97ed40194a1547e114ca1c682f44283f39dfa49&client_secret=****&redirect_uri=https://example.com/oauth/callback'
When using Coinbase iOS SDK on mobile side and Python SDK on the backend side, looks like by design one should put client_secret on the mobile side to be able to exchange temporary code with access_token during OAUTH.
Instead of being forced to store client_secret on mobile side, we would like to send temporary code to our backend which can than exchange this code with access_token/refresh_token. This way client_secret will be stored only on our backend.
For this we need Coinbase Python SDK to provide exchange_code_with_token method which will implement the below call.
curl https://api.coinbase.com/oauth/token \ -X POST \ -d 'grant_type=authorization_code&code=4c666b5c0c0d9d3140f2e0776cbe245f3143011d82b7a2c2a590cc7e20b79ae8&client_id=1532c63424622b6e9c4654e7f97ed40194a1547e114ca1c682f44283f39dfa49&client_secret=****&redirect_uri=https://example.com/oauth/callback'