clientidclientsecret

Client ID and client secret are credentials used by OAuth 2.0 and OpenID Connect clients to identify and authenticate to an authorization server. The client_id is a public identifier issued during registration and is included in requests to the authorization and token endpoints. The client_secret is a confidential value associated with the client_id and is used to prove the client's ownership of the registration. Together, they enable the authorization server to recognize which application is requesting access and, in some flows, to verify that the request comes from a trusted backend.

Client ID details: The client_id is typically a long, opaque string that uniquely identifies the client across the authorization server. It is not meant to remain secret and may be exposed in browser-based or mobile apps, depending on the architecture. It is included in various endpoints and in discovery documents to describe the client.

Client secret details: The client_secret is intended to be kept confidential by the client application. It is used in token requests to authenticate the client, commonly via HTTP Basic authentication or within the request body, depending on the grant type and server configuration. Secrets should never be embedded in client-side code or distributed to end users and should be stored securely on the server. Rotation and revocation of secrets are important security practices.

Security considerations: Protect the secret with strong storage, enforce TLS for all communications, and restrict where credentials can be used. Use PKCE for public clients that cannot securely store a secret. Regularly rotate secrets, monitor usage for anomalies, and revoke compromised credentials. Distinguishing between public and confidential clients helps determine appropriate authentication methods.

In practice, the authorization server assigns both a client_id and, for confidential clients, a client_secret during registration. These credentials are used to authorize and authenticate the client in token requests and, when required, to establish trust between the client and the authorization server.