A confidential client is an OAuth application capable of storing credentials securely and using them to authenticate requests to an authorization server. It normally runs on a server, where its code and secrets are not exposed. A browser-based or mobile public client cannot protect credentials in the same way. section 7.3 section 10.4
The distinction matters because exposed client code cannot safely contain a client secret. FAPI 2.0 therefore requires OAuth clients to be confidential and has them handle authorization-server interactions through a back channel, securely obtaining access, refresh, and ID tokens. section 10.4
Authorization code flow for a web server
A job portal sends a user to an authorization server with a client ID, redirect URI, and response type code. After login and consent, the server redirects the user back with an authorization code. The confidential client exchanges that code for an access token using its client ID and highly sensitive client secret. Keep the secret on the server; never expose it in browser code. section 7.4.1
A confidential client can authenticate with the authorization server by using:
- Mutual TLS (mTLS). section 10.4
- private_key_jwt, which signs a new JWT for each request with a registered private key. section 10.4
