# Integration Patterns

To integrate sgID into your application, you need to understand the different OAuth 2.0 flows based on industry standards. The most popular flows are the **authorization code flow** (for confidential clients), **implicit flow** (for public clients), and **hybrid flow** (for public clients). 

Currently, sgID does not support public clients due to the fact that sgID clients need to be able to keep a secret for its end-to-end encryption (E2EE) to work. Therefore, sgID only supports the **authorization code flow**.

### What are public clients?

Public clients, such as standalone single-page apps (SPA) or native mobile apps, cannot keep a secret because their source code can easily be inspected to reveal secrets or credentials. As such, any secret for client authentication, such as the OAuth 2.0 client secret or the sgID client private key, is rendered public. This makes it easy to impersonate these clients. As [Okta notes](https://developer.okta.com/blog/2022/06/01/oauth-public-client-identity), currently "there aren’t any reliable mechanisms for authenticating pure SPA clients in a browser".

### What are confidential clients?

Confidential clients, on the other hand, can maintain the confidentiality of their client credentials or use other secure client authentication methods. They consist of two components:

1. A frontend app, which can be a SPA, native mobile app, or server-side rendered (SSR) frontend, and 
2. A backend server that communicates with the sgID server's OpenID Connect (OIDC) endpoints

### What does this mean for sgID?

Since SPAs or mobile apps cannot keep secrets, they cannot be trusted to communicate with the sgID authorization server. Therefore, all communication between the client and sgID must go through the backend server, and the frontend component is **not considered an OAuth client**.

sgID uses E2EE to keep the transmission of data from the end user to the client private from sgID itself. For this to work, the client needs its own private key to decrypt the end user's data. Since the private key needs to be kept secret, sgID can currently only support confidential clients.

In this documentation, we will discuss three integration patterns: 

1. [Web Server and SSR Frontend](/learn-the-basics/integration-patterns/web-server-and-ssr-frontend.md)
2. [Backend for SPA Frontend (BFF)](/learn-the-basics/integration-patterns/backend-for-single-page-app-spa-frontend-bff.md)

These integration patterns will help you implement the OAuth 2.0 flows and integrate sgID into your application while ensuring confidentiality and security.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.id.gov.sg/learn-the-basics/integration-patterns.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.