Should the Auth token and/or client ID be secret?

[dkim19375]

Thanks!