Authentication in a desktop application

Client ID’s are considered public, the secrets and oauth tokens are private.