Providing API Secrets to client

[KSchmi]

The client_id of the vendor will be sent as the subject (sub) claim in the the access token (which is a JWT) that is passed in the authorization header by the vendor when calling your API. So, you can have a table on your side that maps vendor client_ids to their respective vendors and proper permissions for that user principle.