Internal/public oauthclients. Mainly every client should have an internal one for use with the internal api and they should be allowed to create a public one.