Client id vs secret

[smallem]

Hello,
when do we need to send Client id vs Secret (is it based on whether the client is non-interactive)?
Also I am confused regarding the certificate: when do we need to use it?

Thanks

[ricardo.batista]

The client id is just an identifier for the client you’re using for authentication. It can be publicly shared. The client secret should be protected and not shared publicly. If ever the client secret gets compromised, you should rotate it. Anyone with the client id and secret could just do a client credentials authentication and get authorized.

I think you first need to determine which OAuth 2.0 flow you should use and then you can see the How to implement the flow section from the grant you’ve chosen, linked in that document. A few examples are:

Implicit Flow with Form Post

Call Your API Using the Client Credentials Flow

Call Your API Using the Authorization Code Flow

[smallem]

but can I just send the secret (without clientId) to do an authentication and get authorized.