A client secret is a private credential used by an application to prove its identity during authentication flows, especially in OAuth and other delegated access systems. It is usually issued alongside a client ID, but unlike the ID, the secret must be kept confidential.
Security matters because a leaked client secret can let an attacker impersonate the app, request access tokens, or abuse APIs within the permissions already granted to that integration. In real attacks, stolen secrets are often used to quietly pull data through legitimate channels, making the activity look like normal application traffic. Defenders reduce this risk by storing secrets outside source code, rotating them regularly, limiting app scopes, monitoring API usage for unusual patterns, and revoking credentials quickly when compromise is suspected.