Flashii Docs

(旧Railgun) if it ain't broke, we'll break it

User Tools

Site Tools

You are here: start » oauth » client-types
oauth:client-types

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

oauth:client-types [2026/02/11 19:43] – created flashoauth:client-types [2026/02/11 20:02] (current) – link to patchii flash
Line 5: Line 5:
   * **Public clients** are only issued a Client ID and no Client Secret as they lack the ability to store confidential values. An example of such a client would be one that performs its interaction with the API entirely on the user agent, there's not additional backend layer inbetween.   * **Public clients** are only issued a Client ID and no Client Secret as they lack the ability to store confidential values. An example of such a client would be one that performs its interaction with the API entirely on the user agent, there's not additional backend layer inbetween.
   * **Confidential clients** are issued both a Client ID and Client Secret and are able to perform secure client authentication. As the name suggests, the Client Secret acts as a password and should be kept private on a backend server. Bearer tokens obtained through this method can still be used to make requests to the API directly from the user agent. If this is not desirable, the client backend server should implement its own session system so the access and refresh tokens can be kept confidential.   * **Confidential clients** are issued both a Client ID and Client Secret and are able to perform secure client authentication. As the name suggests, the Client Secret acts as a password and should be kept private on a backend server. Bearer tokens obtained through this method can still be used to make requests to the API directly from the user agent. If this is not desirable, the client backend server should implement its own session system so the access and refresh tokens can be kept confidential.
-  * **Trusted clients** are specific to Flashii and are an extension to the Confidential client type. Developers are not able to select this client type on their own and it is only meant to be used by official Flashii/second-party applications such as Patchii. Rather than asking for approval, authorization requests are accepted automatically.+  * **Trusted clients** are specific to Flashii and are an extension to the Confidential client type. Developers are not able to select this client type on their own and it is only meant to be used by official Flashii/second-party applications such as [[https://patchii.net|Patchii]]. Rather than asking for approval, authorization requests are accepted automatically.
  
 When registering your client/application, you will be asked what level of confidentiality your client is capable of, but an easy rule of thumb is: if everything is client side pick **public**, if there's a backend server inbetween pick **confidential**! When registering your client/application, you will be asked what level of confidentiality your client is capable of, but an easy rule of thumb is: if everything is client side pick **public**, if there's a backend server inbetween pick **confidential**!
oauth/client-types.1770839001.txt.gz · Last modified: by flash