Auth Matrix
Purpose: Explain client types in plain English.
Use this when: You need to decide whether code exchange happens in the app or on the backend.
Do not use this when: You only need Content or Search examples.
Backend required: Depends on the selected Developer Console app type and API family.
Allowed runtimes: Node.js, serverless functions, workers, browser apps, mobile apps.
Required credentials: client_id always. client_secret only for confidential clients.
Minimal import: @quranjs/api/server and @quranjs/api/public.
| Client type | What it means | Can hold client_secret? | Where code exchange happens | Typical SDK use |
|---|---|---|---|---|
| Confidential client | Backend/server app selected in Developer Console | Yes, on the backend only | Backend | frontend uses public, backend uses server |
| Public client | Frontend or mobile app selected in Developer Console | No | App or browser with PKCE | public only |
| Confidential-proxy app | SDK frontend paired with a confidential backend/server app | Backend only | Backend | frontend uses public, backend uses server |
Short Answer
- The app type selected in Developer Console determines whether the OAuth2 client is public or confidential.
- Frontend or mobile apps are public: exchange in the app with PKCE and no secret.
- Backend/server apps are confidential: start PKCE in the frontend when applicable, then exchange and refresh on the backend.
- Apps that need Content or Search require a backend/server integration even if they also have a browser or mobile frontend.
- Never put
client_secretin frontend or mobile code. - If you are choosing between SPA only, mobile only, or frontend plus backend, read App Shapes.