A client secret is confidential information an OAuth 2 client presents to an authorization server to authenticate itself. It plays a role similar to a user password, while the client ID identifies the client. The server checks both according to the configured client authentication method. section 14.1
In a Spring OAuth 2 client, the secret is supplied as application properties after the application is registered with an identity provider. For well-known providers such as Google, GitHub, Okta, and Facebook, Spring Security supplies most protocol details; the application configures its client credentials. section 16.1.1 section 16.1.2
A client secret participates in several related configuration decisions:
- Register the application with the provider to obtain its unique client ID and client secret. section 16.1.1
- Choose how the authorization server expects the client to authenticate, such as client secret basic. section 14.1
- Keep credentials for each enabled provider separate when offering several login choices. section 16.1.2
Spring application properties
spring.security.oauth2.client.registration.google.client-id=790… spring.security.oauth2.client.registration.google.client-secret=GOC… The same pattern applies to GitHub with its provider-specific registration key. Spring Security uses these credentials when the authorization-code login flow communicates with the provider.
