add note for client secret and ID