Public Apps are issued which credential(s) because they cannot maintain the confidentiality of a client secret?

Public Apps are issued which credential(s) because they cannot maintain the confidentiality of a client secret?

• A. Client ID and client secret
• B. Only a client ID
• C. Username and password
• D. OAuth refresh token

Answer: (B)

Public apps can’t keep a client secret secure, since the secret would be exposed in the app itself (like in mobile or browser-based apps). Because of that, only a client ID is issued to identify the application without requiring a secret that could be compromised. This is why public clients use the client ID alone, often with PKCE to help protect the authorization process. Including a client secret would imply a confidential credential that the app cannot safely store, so it’s not appropriate for public apps. Username and password are user credentials, not the app’s identity, and OAuth refresh tokens are tokens used to obtain new access tokens—not the identifier the app presents to the authorization server.

Public apps can’t keep a client secret secure, since the secret would be exposed in the app itself (like in mobile or browser-based apps). Because of that, only a client ID is issued to identify the application without requiring a secret that could be compromised. This is why public clients use the client ID alone, often with PKCE to help protect the authorization process.

Including a client secret would imply a confidential credential that the app cannot safely store, so it’s not appropriate for public apps. Username and password are user credentials, not the app’s identity, and OAuth refresh tokens are tokens used to obtain new access tokens—not the identifier the app presents to the authorization server.