OAuth API for Mobile - How to accomplish? Whitelist?

If you know how to do this already I’d recommend looking at the implicit grant flow. The final token will be included after the #.