What the need of the client secret in the Web3Auth Dashboard?

[yashovardhan]

While making a new application, I saw two values being given in the Plug and Play section. I know the Web3Auth constructor needs a Client ID, but I never used a client secret. What's the use case for that? When should I use it? Is there a security concern about exposing my client id and client secret?

Asked by multiple people on Telegram/ Discord channels.

[himanshuchawla009]

• ClientSecret is a secret that signs your whitelisted domain and stores the signature in the backend. You don't need to use it if you are whitelisting your domain on dashboard.web3auth.io because when you whitelist your domain on dashboard.web3auth.io, we store a signature on the backend. However, if you want to whitelist your domains programmatically then the client secret can be used. Refer to the answer given below to know more about it:-

• https://github.com/orgs/Web3Auth/discussions/398

• Also it is not safe to keep clientSecret publicly but it is safe to keep clientId in public.