Embedded user-agent, commonly implemented with WebView[2], are an alternative method for authorizing native applications. They are however unsafe for use by third-parties by definition. They involve the user signing in with their full login credentials, only to have them down scoped to less powerful OAuth 2.0 credentials.