Hey there @r00li!
That is totally correct. When going for native mobile app you should use the Proof Key for Code Exchange (PKCE) OAuth 2.0 grant. Here’s more on that:
and here’s more on the implementation itself:
https://auth0.com/docs/api-auth/tutorials/authorization-code-grant-pkce
Let me know if that helps!