# Picking the application type
Auth0 classifies apps on three axes: application type, credential security (public vs confidential), and ownership (first-party vs third-party).
## The four types
- Regular Web Application: server-rendered or server-driven (Express, Django, Rails, Next.js with a backend). Confidential: the server holds a client secret.
- Single Page Application: JS in the browser calling APIs (React, Vue, Angular). Public: no secret can be kept in the bundle. PKCE only.
- Native: mobile/desktop (iOS, Android, Electron, React Native). Public: no secret in the binary. PKCE only.
- Machine to Machine: daemons, CLIs, backend services, no user involved. Confidential: client_credentials grant.
## Decision rule
Can your code keep a secret? Server-side yes -> Regular Web or M2M. Browser or device no -> SPA or Native.
Is there a user logging in? Yes -> not M2M. No user -> M2M.
## What the type changes
- Grant types: public apps get implicit, authorization_code, refresh_token by default. Confidential apps can use client_credentials. A Regular Web app registered as SPA will fail when the server tries client_secret auth.
- Token endpoint auth: confidential apps use client_secret_basic/post or private_key_jwt. Public apps must not send a secret.
- Refresh tokens: SPAs and native apps use rotating refresh tokens (reuse detection on). Regular web apps keep server sessions instead.
## The Next.js trap
Next.js apps with only client-side auth are SPAs; Next.js apps with server components/sessions are Regular Web. The Auth0 Next.js v4 SDK assumes Regular Web (it needs AUTH0_CLIENT_SECRET). If you built client-only and registered SPA, switch the dashboard type or move sessions server-side. Do not paste a client secret into browser code to paper over the mismatch.
## Checklist
- Type matches where the secret lives.
- Changing type later is a dashboard edit plus a grant-type review, not a rebuild.