Should the Auth token and/or client ID be secret?

If the application is to be installed to the users computer, then you would use impicit auth, which can generate a token thats valid for around 60 days

That only uses a client_id to generate a token.

1 Like