“Client secret” is secret and only known to application and server. It is used to authorize a client and get access token.