I think &quot;secret&quot; is a misnomer here.<p><i>The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your application. (In this context, the client secret is obviously not treated as a secret.)</i><p><a href="https:&#x2F;&#x2F;developers.google.com&#x2F;identity&#x2F;protocols&#x2F;OAuth2" rel="nofollow">https:&#x2F;&#x2F;developers.google.com&#x2F;identity&#x2F;protocols&#x2F;OAuth2</a> (under &quot;Installed Applications&quot;)