Which of the following is considered a confidential OAuth2 client?

According to the PingAM 8.0.2 documentation on "OAuth 2.0 Client Authentication," clients are categorized into two types based on their ability to maintain the confidentiality of their credentials: Public and Confidential.

AConfidential Clientis defined as an application that is capable of securely storing a client_secret or a private key.1These are typically applications where the code and configuration are not exposed to the end user.Web Applications(Option D) are the classic example of confidential clients because they run on a secure back-end server.2The server-side code can store and use a secret to authenticate with PingAM's token endpoint without the risk of the secret being leaked to the user-agent or a third party.

In contrast:

Web Browsers(Option C) andJavaScript clients(Option B) are consideredPublic Clients.3Since the code runs within the user's browser, any secret embedded in the application would be visible to the user via "View Source" or developer tools.4

Desktop clients(Option A) and native mobile apps are also categorized as public clients in the OAuth2 specification (RFC 6749) because they are distributed to end-user devices.5Even if the secret is obfuscated, it can be extracted through reverse engineering or decompilation.

For confidential clients, PingAM 8.0.2 supports various authentication methods at the token endpoint, including client_secret_basic, client_secret_post, and more secure options likeMutual TLS (mTLS)orPrivate Key JWT. By correctly identifying a client as confidential, administrators can enforce these stronger authentication requirements, ensuring that the client is indeed the entity it claims to be before granting access or refresh tokens.