I think you're confusing the security requirements for client IDs and secrets.
- Client ID: Must be unique, better if unguessable. While they are typically not publicly advertised, they are not treated as carefully as secrets are.
- Secrets: Must be unguessable and kept private. A potential leak of a secret is a security incident, requiring immediate revocation of the key.
What your client IDs look like is sort of a matter of taste. The examples in the oauth.com site you reference includes keys of varying sizes and formats. A random number is a fine choice. Something like (in pseudocode):
clientID = base64Encode(secureRandom(16)); // 16 bytes, 128 bits, 22 characters
In some situations you could use a non-secure random number, but there are situations where that may lead to predictability. So just stick with the secure random number generator - it's only a little slower and guaranteed to be safe.
The only way to generate a secret is with a secure random number generator:
secret = base64Encode(secureRandom(32)); // 32 bytes, 256 bits, 43 characters
Secrets should never be stored in clear-text. Encrypt them and store the encryption key somewhere secure.
You mentioned GUIDs, but even the random version 4 ones vary by implementation, some being secure and others not. So I'd just stay away from them. You also mentioned SHA256 and SHA512 hash algorithms. It is possible to use those in the calculation of a random number, but it's complex to get that right. Just stick with a secure random number generator and you'll be safe.
As you are already using Spring, RandomValueStringGenerator is probably a good choice for the implementation. Just create generators of the correct number of bytes. You can also look at the source code of that class for reference.