I think "secret" is a misnomer here. The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your applica

I think "secret" is a misnomer here. The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your application. (In this context, the client secret is obviously not treated as a secret.) https://developers.google.com/identity/protocols/OAuth2 https://developers.google.com/identity/protocols/OAuth2 (under "Installed Applications")