Client secret
A client secret is a confidential credential an OAuth client can use to authenticate itself to an authorization server.
It authenticates the application
A client secret is not an employee’s password, and it is not an access token. The application uses the secret when authenticating to the authorization server. An access token serves a different purpose: representing authorization when calling a protected resource.
The secret also does not define the application’s permissions. Replacing a credential on an existing application can leave its existing access intact. The review needs to cover both who can authenticate as the application and what that application is allowed to do.
A routine replacement can change who has access
A request to generate a new secret deserves the same care as other access changes. Confirm the application, the owner authorizing the change, and the approved place where the credential will be stored. Sending a working secret to an unverified support contact can give that recipient a way to authenticate as the client.
The application credential article follows that approval decision. It distinguishes creating a credential from changing permissions and from evidence that the application actually accessed data.
Secrets are one authentication option, not a requirement for every OAuth client. Microsoft recommends managed identities or trusted federated credentials where suitable, with certificate credentials as another alternative. Where a secret remains necessary, give its storage, expiration, replacement, and removal a clear owner. Do not put it in browser code or a repository simply because it belongs to software rather than a person.