I'm told that OAuth client secrets don't have to be secret. Wut?

"The process results in a client ID and, in some cases, a client secret, which you embed in the source code of your application. (In this context, the client secret is obviously not treated as a secret.)" from developers.google.com/identi… I'm confused.

Good find... that is a really confusing sentence. I'm going to try to track that down and see if they can remove it.

BTW, the reason I found this sentence is because the documentation for the "httr" R package linked to it cran.r-project.org/web/packa…