The authorization code flow now supports PKCE, so you can add Sign in with Examplary to a mobile or single-page app without shipping a client secret.
Send a code_challenge and code_challenge_method when you redirect users to authorize, then the matching code_verifier when you exchange the code for tokens. Everything else works exactly as it does today — see the OAuth guide.