The applying mystery you established in the app registration portal for the app. Really don't use the application secret in a native application or single web site app because a client_secret can't be reliably saved on devices or Websites. It's expected for Internet apps and Internet APIs, which may store the client_secret securely around the serve