Cybersecurity glossary
What is an OAuth Client?
Learn what an OAuth client is, how public and confidential clients differ, which grants each should use, and security practices for registering and operating OAuth clients.
Definition
An OAuth client is an application that requests authorization from a resource owner and tokens from an authorization server in order to access protected resources—classified as public or confidential based on its ability to authenticate and protect credentials.
Why the client type decides the security model
OAuth security advice is not one-size-fits-all. An OAuth client might be a hardened backend, a single-page app, a native mobile app, or a batch job. Whether it can keep secrets—and which grant it may use—depends on that shape.
Registering the wrong client type is a root cause of many OAuth incidents.
Client types and typical shapes
Confidential web app
Server-side app with protected client credentials and BFF patterns.
Public SPA
Browser app without a secret; auth code + PKCE, careful token storage.
Native mobile
Public client using claimed HTTPS redirects or loopback with PKCE.
CLI / device
May use device authorization grant or loopback auth code + PKCE.
M2M service
Confidential client using client credentials with tiny scopes.
Third-party integration
External vendor client with explicit consent and reviewable scopes.
How a client obtains and uses tokens
Register with the AS
Receive client_id, allowed grants, redirect URIs, and scopes.
Start an allowed grant
Interactive code+PKCE for users, or client credentials for machines.
Authenticate as required
User login/consent and/or client authentication.
Store tokens appropriately
Secure server storage or hardened platform storage—not world-readable logs.
Call resource servers
Present access tokens; refresh carefully when offline access exists.
Public vs confidential decisions
| Question | Public client | Confidential client |
|---|---|---|
| Can it keep a secret? | No | Yes |
| Recommended user grant | Auth code + PKCE | Auth code + PKCE (+ client auth) |
| Client credentials grant | No | Yes for M2M |
| Token storage risk | Higher (XSS/device) | Lower if server-held |
Client hygiene checklist
- Register separate clients per surface (web, mobile, M2M) and environment.
- Allowlist exact redirect URIs; ban wildcards that enable open redirects.
- Use PKCE for all authorization code clients.
- Never embed client secrets in mobile apps or SPAs.
- Request least-privilege scopes; expand only with new consent.
- Prefer cryptographic client authentication for confidential clients.
- Rotate secrets/keys and revoke unused client registrations.
- Monitor unusual token volumes per client_id for abuse detection.
The practical takeaway
An OAuth client is the application asking for delegated access. Its public or confidential nature dictates grants, authentication, and token handling.
Register clients narrowly, protect them according to their exposure, and never pretend a public app can keep a secret it ships to every user device.
Related security terms
OAuth 2.0
Framework that defines the client role and grant types.
OAuth Authorization Server
Issues tokens to registered clients.
Proof Key for Code Exchange (PKCE)
Required protection for public clients using auth code.
Client Credentials Grant
Machine grant used by confidential clients acting as themselves.
OAuth Scope
Permissions a client must request minimally.
Frequently asked questions
What is an OAuth client in simple terms?
It is the app—website, mobile app, CLI, or backend service—that asks for permission to access an API and then uses the resulting tokens.
What is a confidential vs public client?
Confidential clients can keep a secret (server backends). Public clients cannot (SPAs, native apps), so they must not rely on embedded client secrets.
Which grant should public clients use?
Authorization code with PKCE. Avoid implicit grant and never ship client secrets in mobile/SPA binaries.
What is a client_id?
A public identifier for the registered client. It is not a secret by itself.
How do confidential clients authenticate?
Client secret, private-key JWT, or mTLS—prefer cryptographic client authentication over long-lived shared secrets when possible.
Can one product have multiple OAuth clients?
Yes. Separate clients for web, mobile, and M2M with distinct redirect URIs and scopes improve least privilege and incident response.
What are common client misconfigurations?
Wildcard redirects, overly broad scopes, secrets in front-end code, missing PKCE, and reusing production clients in development.
References
Explore authoritative guidance and frameworks related to oauth client.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.