Using most OAuth 2.0 flows, a client application can identify itself to the authorization server by means of a "client id" and "client secret."
The OAuth 2 specification says that the client secret should indeed be kept secret.
However, if the client secret is inside of the application, then it's not secret - someone can use a debugger, disassembler, etc to view it.
So I am not sure the effectiveness and/or purpose of this client secret. Furthermore, are there any recommendations for securing a client secret on a client under the control of the general populace? The purpose here is to establish some form of trust between the client application and the Authorization server, independent of the resource owner (user).
Finally, what is the difference between using an OAuth flow without a client secret vs. using one with a client secret and not keeping that "client secret" actually secret?