For Web Server applications, Google says to use the application type 'Web Application' - see:
https://developers.google.com/identity/protocols/OAuth2WebServer
But from testing, this appears to allow the end user to change the response_type in the url the user is sent to from 'code' to 'token' which then allows them to get an access token directly back at the end of the authentication flow.
Some other API providers provide a mechanism in the setup screen for the OAuth application to disable this auth flow completely which seems sensible.
Am I missing something here?