I see why it is obviously bad to store a secret key and client ID in the source code for a web application. However, how do you go about the alternative? Surely, that information has to be stored somewhere. Is it stored in a local text file on, say, an EC2 instance which is running the server that gets read by the application?
I've been going through this recently so I'll give my most recent answer.
If one is already bought into the AWS system, Secrets Manager exists. Other cloud providers likely have a similar mechanism.
In effect your secret is stored encrypted in AWS cloud. Your app must make an encrypted API call (bindings for multiple languages exist). At that point secrets are only stored in memory during runtime and otherwise encrypted at rest.
This type of thing can obviously be homegrown but at 40 cents a secret per month the use case would likely be pretty special to pay back the NRE at that rate.