title: What's the purpose of the client secret in OAuth2?
body: <p>I have an app that offers an API. This app is an OAuth2 provider.</p>
  
  <p>I want to access this API (read &amp; write) with a client-side only app. I'm using <a href="https://github.com/andreassolberg/jso" rel="noreferrer">JSO</a> to make this easier.</p>
  
  <p>It works great.</p>
  
  <p>The thing is, I don't have to enter my client secret (of the application I registered in my app) anywhere. And I understand why, it would then be available to anyone.</p>
  
  <p>So, if I can access my api without the client secret, could you explain to me what is its purpose?</p>