OAuth2 docs. Always check client_secret for client configuration endpoints.