title: OAuth 2 for native application - what is difference between public and confidential client types?
body: <p>I trying to implement OAuth 2 provider for web service and then built native application on top of it. Also I want give access to API for third-party developers.</p>
  
  <p>I read OAuth 2 specification already and can't choose right flow. I want authenticate both CLI and GUI apps as well.</p>
  
  <p>First of all we have two client types - public and confidential. Of course both GUI and CLI apps will be public. But what is difference between this two types? In this case for what I need client_secret if I can get access token without it just by changing client type?</p>
  
  <p>I tried to look at some API implementations of popular services like GitHub. But they use HTTP Basic Auth. Not sure it is a good idea.</p>
  
  <p>Is there any particular difference? Does one improve security over the other?</p>