Know which OAuth clients can authenticate themselves.
Public clients cannot safely keep a shared secret. Confidential clients can authenticate to the authorization server with protected credentials when the server supports them.
Why this lesson?
A server-side application needs to authenticate itself when requesting tokens, while a browser application must not pretend an embedded shared secret is confidential.
Learning goal and prerequisites
Classify the client
The authorization server registers the client according to how it runs. A browser or native app is normally a public client because software distributed to users cannot keep one shared secret confidential. A server-side application can be a confidential client when it can protect its credentials.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
OAuth clients do not all have the same ability to protect credentials. A backend application can often keep a secret or private key in a controlled server environment. A browser or installed application runs on a device the user controls, so any shared secret built into that software can eventually be extracted. OAuth needs to account for that difference.
A confidential client is a client that can protect credentials well enough to authenticate itself to the authorization server. It might use a client secret or a signed assertion created with a private key. A public client cannot safely depend on a built-in shared secret, so it uses other protections such as Proof Key for Code Exchange instead of pretending the embedded secret is confidential.
Client authentication is useful when the authorization server needs proof of which confidential client is making a token request. It can help apply client-specific policy and prevent another client from using credentials that do not belong to it.
Client authentication does not authenticate the user and does not grant application programming interface (API) access by itself. The authorization server still evaluates the grant, requested resource, scopes, and user approval when a user is involved. The key design rule is to choose a client-authentication method that matches what the client can truly keep secret.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.