title: Client IDs and secrets
body: <pre><code>Request URL:
  POST https://example.com/oauth/token
  Request Headers:
    Content-Type: application/x-www-form-urlencoded
  Request POST Body:
  grant_type=password&amp;username=joebloggs&amp;
     password=password1234&amp;client_id=myclient&amp;client_secret=myclientsecret
  
  Response:
  {
    "access_token": "omitted for brevity",
    "token_type": "bearer",
    "expires_in": 1200,
    "refresh_token": "b3cc9c66b86340c5b743f2a7cec9d2f1"
  }
  </code></pre>
  
  <p>I would like to protect my Umbraco web api endpoints using a JWT sent from a single page app. I found <a href="https://github.com/mattbrailsford/umbraco-authu" rel="nofollow noreferrer">this lib</a> to cover most of my needs.</p>
  
  <p>Since I make use of the <code>InMemoryOAuthClientStore</code> the documentation states that a client id and secret must be provided with the authentication request (I presume this is used to match an <code>OAuthClient</code> in the store?):</p>
  
  <p><strong>client_id</strong> = A valid client id (Only required if a client store is configured)</p>
  
  <p><strong>client_secret</strong> = A valid client secret (Only required if a client store is configured, and the client is "secure")</p>
  
  <p>I would like to know how they are intended to be used. If I make this authorization call to <code>https://example.com/oauth/token</code> using an AJAX call from the client, I need to store the id and secret on the client side. My gut feeling tells me that's not how it's intended to be used. </p>
  
  <p>On the other hand, the client id and secret are accompanied with user credentials in this case, so they're worthless without a valid username and password. </p>
  
  <p>Someone please shed some light on this.</p>