@some-bear-63847 I think the question you are really asking here is what is is the difference between a public and a confidential client. [ https://datatracker.ietf.org/doc/html/rfc6749#section-2.1 ] Which you could otherwise distinguish as something running on the user's hardware (e.g. phone) or something running on your hardware (e.g. a service in your cloud.) The security considerations are slightly different in each case.