OAuth2 Client Types — Confidential vs Public Clients and Security Implications

In this tutorial, you will learn about OAuth2 Client Types. We cover key concepts, practical examples, and best practices to help you master this topic.

OAuth2 client types — confidential and public — determine whether a client can securely store a client secret and therefore which grant types it can use.

What You'll Learn

The difference between confidential and public clients, how client type determines grant type selection, and security implications of each.

Why It Matters

Choosing the wrong client type leads to insecure implementation. A mobile app classified as confidential cannot actually keep a secret — the secret is extractable. Public clients must use PKCE instead of client secrets.

Real-World Use

Google classifies web apps as confidential (have client_secret), Android/iOS apps as public (no client_secret, use PKCE), and SPAs as public (no client_secret, use PKCE).

flowchart TD
    A["Client Type?"] --> B["Confidential\nCan keep secret"]
    A --> C["Public\nCannot keep secret"]
    B --> D["Web app (backend)\nServer-side script"]
    B --> E["Can use:\nAuthorization Code\nClient Credentials"]
    C --> F["SPA, Mobile app\nDesktop app"]
    C --> G["Must use:\nPKCE\nNo client_secret"]
    style A fill:#dbeafe,stroke:#2563eb
    style B fill:#dcfce7,stroke:#16a34a
    style C fill:#fef3c7,stroke:#d97706
    style D fill:#dcfce7,stroke:#16a34a
    style F fill:#fef3c7,stroke:#d97706

Client Type Comparison

Code Example: Client Registration

# Confidential client registration
confidential_client = {
    "client_id": "web-app-1",
    "client_secret": "s3cret-v4lue-abc123",
    "client_type": "confidential",
    "redirect_uris": ["https://app.dodatech.com/callback"],
    "grant_types": ["authorization_code", "client_credentials"]
}

# Public client registration
public_client = {
    "client_id": "mobile-app-1",
    "client_secret": None,  # No secret
    "client_type": "public",
    "redirect_uris": [
        "https://app.dodatech.com/callback",
        "myapp://callback"
    ],
    "grant_types": ["authorization_code"],
    "token_endpoint_auth_method": "none"  # PKCE
}

Common Mistakes

1. Putting Client Secrets in Public Clients

A client secret in a mobile app binary or SPA JavaScript can be extracted. It provides no security — use PKCE.

2. Using the Same Client for Both Types

A client should be either confidential or public. If your app has both a web backend and a mobile app, register two separate clients.

3. Allowing Client Credentials for Public Clients

Client Credentials requires client authentication. Public clients cannot authenticate. Never enable Client Credentials for public clients.

4. Not Enforcing Token Endpoint Auth Method

Confidential clients must authenticate at the token endpoint (client_secret_basic or client_secret_post). Public clients must not.

5. Ignoring client_id Security

Even public clients have a client_id. While not secret, the client_id should still be validated and rate-limited.

Practice Questions

1. What is the difference between confidential and public clients?
2. Why can't mobile apps keep a client secret?
3. What grant type should a public client use?
4. Can a public client use Client Credentials?
5. Should you register one client for your web and mobile apps?

Answers:

1. Confidential clients can securely store secrets (backend server). Public clients cannot (mobile, SPA).
2. Mobile app binaries can be decompiled. Any embedded secret can be extracted.
3. Authorization Code with PKCE. No client_secret is needed.
4. No. Client Credentials requires client authentication. Public clients cannot authenticate.
5. No. Register separate clients for each platform. A web app client (confidential) and a mobile app client (public).

Challenge: You are building a SaaS with a web app (Django backend), mobile app (iOS/Android), and SPA (React). Design the client registration Strategy. Which clients are confidential vs public? What grant types does each use?

FAQ

Mini Project

Create a client registration service that accepts confidential and public client registrations, enforces the correct grant types for each type, and validates redirect URIs.

What's Next

Now learn about OAuth2 Scopes — granular permissions for fine-grained access control.