title: Store client secret securely
body: <p>I know that a <a href="https://www.rfc-editor.org/rfc/rfc6819#section-5.2.3.1" rel="nofollow noreferrer">public client shouldn't use a client secret</a> because, no matter how much you obfuscate it, it won't be protected from <a href="https://stackoverflow.com/questions/13854425/how-to-avoid-reverse-engineering-of-an-apk-file">reverse engineering</a>.</p>
  <p>But, the people in charge of the service I am authenticating to don't want to/can't change it. So, I need to store the client secret and try to protect it from reverse engineering as much as I can.</p>
  <p>So, I thought of encrypting it using at build time using gradle and store it in a file. Then, when I need it at run time I decrypt it. But now I have to solve the problem of <strong>how to store the encryption key</strong>...</p>
  <p>I don't know much about security, so, I don't know if this can be solved, or if Android (min sdk 15) provides any mechanism for this kind of scenarios.</p>
  <p>Any idea?</p>