> ## Documentation Index
> Fetch the complete documentation index at: https://docs.notifique.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Building a client

> Choose public vs confidential clients, PKCE, and production best practices.

<Tip>
  **Architecture** summary before you code. Copy-paste flow: [Quick Start](/en/oauth-api/como-funciona/quick-start). Deep dive: [Technical guide](/en/oauth-api/como-funciona/guia-tecnico-cliente).
</Tip>

## Public vs confidential

| Type             | Secret | Typical          | Token endpoint               |
| ---------------- | :----: | ---------------- | ---------------------------- |
| **Confidential** |   Yes  | Web + backend    | `client_secret_basic` + PKCE |
| **Public**       |   No   | SPA, mobile, CLI | `none` + PKCE                |

<Warning>
  Never put `client_secret` in browser JavaScript or mobile apps. Use a **public** client + PKCE.
</Warning>

## One-line flow

Register → authorize (browser + PKCE) → token → `/v1` with Bearer → refresh on expiry → revoke on disconnect.

## Production checklist

* Exact redirect URI (trailing slash matters)
* Validate `state` on callback
* Keep `code_verifier` until token exchange
* Persist refresh tokens **atomically** (they rotate)
* Minimum scopes at authorize

## Next steps

* [Technical guide](/en/oauth-api/como-funciona/guia-tecnico-cliente)
* [Scopes](/en/oauth-api/como-funciona/escopos)
* OpenAPI under **More**