---
title: Authorization and authentication by application type
description: PingOne supports several application types. When you make a POST {{apiPath}}/v1/environments/{{envID}}/applications request to define a new application, you must specify the type property that best describes the application. PingOne supports the following application types:
component: pingone-api
page_id: pingone-api:foundations:authentication-concepts/authorization-and-authentication-by-application-type
canonical_url: https://developer.pingidentity.com/pingone-api/foundations/authentication-concepts/authorization-and-authentication-by-application-type.html
section_ids:
  authorization-flow-steps: Authorization flow steps
---

# Authorization and authentication by application type

PingOne supports several application types. When you make a `POST {{apiPath}}/v1/environments/{{envID}}/applications` request to define a new application, you must specify the `type` property that best describes the application. PingOne supports the following application types:

* [Web applications](authorization-and-authentication-by-application-type/web-applications.html)

  A browser-based application with a server-side component, such as ASP, CGI, JSP/Java, Node.js, or Ruby on Rails applications.

* [Native applications](authorization-and-authentication-by-application-type/native-and-single-page-applications.html)

  An application that is installed and run directly on the local operating system, like Java, Objective-C, Swift, or React applications. Native applications are typically intended for native devices.

* [Single-page applications](authorization-and-authentication-by-application-type/native-and-single-page-applications.html)

  A browser-based application that runs on the front-end with no server-side component, such as Sencha Touch, AngularJS, and React applications. A single-page application runs on the client side after it loads, so it cannot keep a client secret.

* [Non-interactive applications](authorization-and-authentication-by-application-type/non-interactive-applications.html)

  A web application that does not require user interaction through the web browser, like a command line interface, a service, or a daemon.

* [Worker applications](authorization-and-authentication-by-application-type/worker-applications.html)

  An administrator application that can interact with platform APIs. Access to platform APIs is determined by the user's or application's role assignments.

## Authorization flow steps

An authorization grant gives applications the capability to authenticate users and access secure resources. The following steps describe the application authorization flow:

1. The application initiates the authorization flow through a `GET` or `POST` request to the `authorize` endpoint.

2. The authorization service generates the access token for the `implicit` grant.

3. For `authorization_code` and `client_credentials` grants, the application calls the `/{{envID}}/as/token` endpoint to acquire the access token.

For more information about authorization, refer to [OpenID Connect/OAuth 2](../auth-apis-overview/openid-connect-oauth-2.html).