docs: def internal_auth_client(requires_instance=False, force_new_client=False):
      """
      Looks up the values for this CLI's Instance Client in config
  
      If none exists and requires_instance is True or force_new_client is True,
      registers a new Instance Client with GLobus Auth
  
      If none exists and requires_instance is false, defaults to a Native Client
      for backwards compatibility
  
      Returns either a NativeAppAuthClient or a ConfidentialAppAuthClient
      """
      client_id = lookup_option(CLIENT_ID_OPTNAME)
      client_secret = lookup_option(CLIENT_SECRET_OPTNAME)
      template_id = lookup_option(TEMPLATE_ID_OPTNAME) or DEFAULT_TEMPLATE_ID
      template_client = internal_native_client()
      existing = client_id and client_secret
  
      # if we are forcing a new client, delete any existing client
      if force_new_client and existing:
          existing_client = globus_sdk.ConfidentialAppAuthClient(client_id, client_secret)
          try:
              existing_client.delete("/v2/api/clients/{}".format(client_id))
  
          # if the client secret has been invalidated or the client has
          # already been removed, we continue on
          except globus_sdk.exc.AuthAPIError:
              pass
  
      # if we require a new client to be made
      if force_new_client or (requires_instance and not existing):
          # register a new instance client with auth
          body = {"client": {"template_id": template_id, "name": "Globus CLI"}}
          res = template_client.post("/v2/api/clients", json_body=body)
  
          # get values and write to config
          credential_data = res["included"]["client_credential"]
          client_id = credential_data["client"]
          client_secret = credential_data["secret"]
          write_option(CLIENT_ID_OPTNAME, client_id)
          write_option(CLIENT_SECRET_OPTNAME, client_secret)
  
          return globus_sdk.ConfidentialAppAuthClient(
              client_id, client_secret, app_name="Globus CLI"
          )
  
      # if we already have a client, just return it
      elif existing:
          return globus_sdk.ConfidentialAppAuthClient(
              client_id, client_secret, app_name="Globus CLI"
          )
  
      # fall-back to a native client to not break old logins
      # TOOD: eventually remove this behavior
      else:
          return template_client