Difference Between OAuth 2.0 Application Type Client and Server

[MichaelFitDev]

Hi Could someone explain to me the difference between  OAuth 2.0 Application Type Client and Server?

What would be the best fit for an app that requires the user to accept my apps access to their fitbit data so I can model it from my Database?

Thanks

Mike

[JeremiahFitbit · Accepted solution]

See App Types in the documentation.

Server (aka "confidential" in OAuth 2.0 terminology): Apps capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server with restricted access to the client credentials), or capable of secure client authentication using other means.

Client (aka "public" in OAuth 2.0 terminology): Apps incapable of maintaining the confidentiality of their credentials (e.g., clients executing on the device used by the resource owner, such as an installed native application or a web browser-based application), and incapable of secure client authentication via any other means.

[jmitchell38488]

@JeremiahFitbit has the definition.

You use Server for Server <=> Server communication, but you use Client predominantly with devices that use self-contained applications, although there are rules about how you implement FitBit in those applications. As Jeremiah stated, this is because of security and confidentiality issues, or if those devices can't connect securely. Server to server connections can be made secure or insecure by use of SSL certificates and there's more control at server and application level for maintaining security and confidentiality.

If you don't need to support device applications and you aren't writing anything for iOS or Android, and you aren't writing a single page application with no backend processing, then Server is the option for you.