The applying top secret you made within the application registration portal in your app. Never use the application solution in a local application or single web page application since a client_secret cannot be reliably saved on equipment or web pages. It really is expected for web apps and World wide web APIs, which might retailer the client_secret