At present we only support R256 (RSA). We should probably support H256 (HMAC) too, taking the client ID & secret from app settings.