I am currently looking into authentication protocols which work well with REST API, in java.
There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, basic HTTP auth, digest etc.. And in all of them there are apparently different meanings of the term "client". In most, from my understanding, this term means web application, or the browser. But in some, for instance basic HTTP authentication, this term refers to the user himself.

I don't understand exactly how can an instance of a web application can be, or needs to be, authenticated.
I know there are certificates involved in the process, but as I see it, they just take care of securely transferring the message to the server, and prevent replay and MITM attacks. In OAuth, there needs to be a token in the cert, after a username+password exchange, but since the username and password belong the user himself, as I understand it, where is the part that authenticates the client?

There are some protocols that use private and public keys in the server side as well as in the client side, which actually makes sure the client is "who it says it is". But do these keys have to be applied to every instance of this web app? I'm confused. 

In which cases, anyway, will we need client authentication? Isn't it enough to authenticate the user and take care of message integrity?