Don't Store Credentials in Code or Resources Bundled with Software Packages

[jankapunkt]

Because of the number of copies of client software, there is limited
benefit in creating a single client id and secret that is shared by
all installations of an application. Such an application by itself
would be considered a "public" client, as it cannot be presumed to be
able to keep client secrets. A secret, burned into the source code
of the application or an associated resource bundle, cannot be
protected from reverse engineering. Secondly, such secrets cannot be
revoked, since this would immediately put all installations out of
work. Moreover, since the authorization server cannot really trust
the client's identifier, it would be dangerous to indicate to end
users the trustworthiness of the client.