Confidential vs. Public Applications - Understanding Client Types

Confidential and Public Applications refer to two classifications of client applications in OAuth 2.0, distinguished by their ability to securely handle credentials like client secrets. Confidential applications can securely store credentials and are typically server-side applications, while public applications cannot securely store credentials and are often client-side apps, such as mobile or desktop applications.

---

• Secured Environment: Runs on servers where direct access by users or attackers is restricted.
• Capability to Secure Secrets: Able to safely store client secrets used for authentication.
• Best Practices: Includes using managed identities, secure storage, and regular rotation of client secrets.

• Run on Client Devices: Such as desktops, mobile devices, or within browsers where access to source code can occur.
• Inability to Secure Secrets: Cannot safely store client secrets due to the risk of exposure.
• Authentication Flow: Uses OAuth 2.0 flows that do not require client secrets for authentication.

• For Confidential Applications: Utilize secure channels for transmitting secrets, use encryption for stored data, and implement strict access controls.
• For Public Applications: Employ strong client-side security measures such as PKCE (Proof Key for Code Exchange) to enhance the security of OAuth flows.

---

A confidential application is one that can secure client credentials (like client IDs and secrets) and use these for authenticating with authorization servers.

Public applications run in environments like personal devices or browsers where the secure storage of credentials is not feasible, making them susceptible to attacks such as reverse engineering.

Confidential applications can use secrets to authenticate and obtain tokens, while public applications typically use alternative methods like PKCE to secure their token exchanges without needing a client secret.

Yes, public applications often use the Authorization Code flow with PKCE, which enhances security for apps unable to hold secrets.