<chapter id="access-types">
    <title>Application and Client Access Types</title>
    <para>
        When you create an Application or OAuth Client you may be wondering what the "Access Types" are.
    </para>
    <para>
        <variablelist>
            <varlistentry>
                <term>confidential</term>
                <listitem>
                    <para>
                        Confidential access type is for clients that need to perform a browser login and that you want
                        to require a client secret when they turn an access code into an access token, (see
                        <ulink url="http://tools.ietf.org/html/rfc6749#section-4.1.3">Access Token Request</ulink> in
                        the OAuth 2.0 spec for more details).  The advantages of this is that it is a little extra security.
                        Since Keycloak requires you to register valid redirect-uris, I'm not exactly sure what this little
                        extra security is though. :)
                        The disadvantages of this access type is that confidential access type is pointless for pure
                        Javascript clients as anybody could easily figure out your client's secret!
                    </para>
                </listitem>
            </varlistentry>
            <varlistentry>
                <term>public</term>
                <listitem>
                    <para>
                        Public access type is for clients that need to perform a browser login and that you feel
                        that the added extra security of confidential access type is not needed.  FYI, Pure javascript
                        clients are by nature public.
                    </para>
                </listitem>
            </varlistentry>
            <varlistentry>
                <term>bearer-only</term>
                <listitem>
                    <para>
                        Bearer-only access type means that the application only allows bearer token requests.  If this
                        is turned on, this application cannot participate in browser logins.
                    </para>
                </listitem>
            </varlistentry>
            <varlistentry>
                <term>direct access only</term>
                <listitem>
                    <para>
                        For OAuth clients, you would also see a "Direct Access Only" switch when creating the OAuth Client.
                        This switch is for oauth clients that only use the  <link linkend='direct-access-grants'>Direct Access Grant</link>
                        protocol to obtain access tokens.
                    </para>
                </listitem>
            </varlistentry>
        </variablelist>
    </para>
</chapter>