The OAuth terminology can be confusing, and many write-ups assume you already know some of it, which doesn’t help.
In OAuth, an “app” is considered a “client”, even if it’s running in a web server in a data center, as it’s a “client” of the other services involved (e.g. the authentication services and the resources/APIs it will access on behalf of the user).
Now if it is running in a web server in a data center, it can be considered “confidential”, as the code/config is not readily available to attackers. Thus the app can hold things like private keys etc. without too much risk.
On the other hand, if the “client” is an app you can install on a PC/mobile device or load into your browser (e.g. a “SPA” app), then this is a “public client”, as attackers can easily access the code and examine it for stored credentials, etc.
In OAuth, an “app” is considered a “client”, even if it’s running in a web server in a data center, as it’s a “client” of the other services involved (e.g. the authentication services and the resources/APIs it will access on behalf of the user).
Now if it is running in a web server in a data center, it can be considered “confidential”, as the code/config is not readily available to attackers. Thus the app can hold things like private keys etc. without too much risk.
On the other hand, if the “client” is an app you can install on a PC/mobile device or load into your browser (e.g. a “SPA” app), then this is a “public client”, as attackers can easily access the code and examine it for stored credentials, etc.
Hopefully that makes sense.