title: Client Credentials Flow or Authorization Code Flow (with PCKE) for a trusted desktop client
body: <p>I'm developing the authentication/authorization architecture for several APIs.</p>
  
  <p>I'm using IdentityServer4 as a Security Token Service (STS).</p>
  
  <p>From what I've read from "Dominick Baier" (one of the persons that built IdentitySever4), <strong>there are only two types of Flows that should be used</strong>:</p>
  
  <ul>
  <li>Client Credentials Flow. (machine-to-machine)</li>
  <li>Authorization Code Flow + PCKE. (for iteractive users).</li>
  </ul>
  
  <p>I have several C# Web API's that will communicate with each (Machine-To-Machine), and I will use the Client Credentials Flow.</p>
  
  <p>But then there are some WPF Desktop Applications, that will need to access some APIs, and don't have a user.
  Which flow should be used?</p>
  
  <p>I've read that:
  Desktop/Native &amp; Mobile Applications should use Authorization with Authorization Code Flow (with Public Client and PKCE), since they are hosted on the Client side, and the Client/Secret is can be leaked (maybe on a Desktop application we can Encrypt the Secret? But then will need to manage a way how to store the secret that decrypts that right?)</p>
  
  <p>Then I've read:
  "Anytime you have a system that isn’t concerned with the end-user identity (and just needs to authenticate the system), use the OAuth2 Client Credential Grant."</p>
  
  <p>For now, this is my case, I'm not concerned with the end-user identity (but maybe in a near future I will).</p>
  
  <p>So since the above points conflict with each other:
  - Which flow should I use? 
  - Can I have a Desktop Client using Clients Credential Flow and be safe?</p>
  
  <p>Also, I've read a bit about Mutual TLS, If I use that, does this change which flow should I use?</p>