Confidential clients must be able to securely safeguard a secret. If your application cannot keep a secret (such as an application that runs in a web browser) you should use the public application type.
system, user, and offline_access scopes require confidential app permissions.
Confidential apps are applications that are able to safely and securely store a secret. Browser based and many mobile applications do not satisfy this security constraint