A confidential client is an application that can securely store a client secret (like a server-side web app), so it authenticates to the authorization server using both its client_id and client_secret. A public client cannot keep secrets securely (like SPAs, mobile apps, or JavaScript running in browsers), so it only identifies with client_id and uses alternative methods like PKCE (Proof Key for Code Exchange). This matters because: public clients are vulnerable to authorization code interception attacks. PKCE adds a cryptographically random 'code_verifier' generated by the client and a 'code_challenge' sent during authorization, verified later during token exchange. Without PKCE or client secrets, an attacker could steal the authorization code and exchange it for tokens.