title: OAuth: Should the client secret be required in the resource request?
body: <p>As far as I understand: The client secret was important in OAuth1, but is not that relevant anymore in OAuth2.</p>
  
  <p>But it seems that companies like Google and Twitter require the client-secret to get an access-token.</p>
  
  <p>From the point of view of the authorization-server (for example Google, Twitter, Github...): In which of these situations is the client-secret recommeneded/(required)?</p>
  
  <ul>
  <li>getting an access-token from the authorization-code.</li>
  <li>getting a new access-token by using the refresh-token.</li>
  <li>getting the resource by the access-token.</li>
  </ul>
  
  <p>Is it enough to require it only to get an access-token by the authorization-code or should it also be commited when someone uses the access-token to get the ressource?</p>
  
  <hr>
  
  <p><strong>TLDR:</strong> In my case: The client-secret is required for the request "get access-token by authorization-code" and for the request "get new access-token &amp; refresh-token by refresh-token". Should I also ask for the client-secret (require it) when a client tries to get the resource by an access-token?</p>