For obvious reasons it is wrong to expose the client secret.

Unfortunately the soundcloud developer documentation is not clear about that. 
The oauth spec offers a couple of possible flows here, all more or less inconvenient:
http://tools.ietf.org/html/draft-ietf-oauth-v2-22#section-9

Actually I think the solution is similar to the client-side flow here:
http://developers.soundcloud.com/docs#authentication

Example: https://soundcloud.com/connect?client_id=609ae0b573913db156968e0ec38c1e26&redirect_uri=http%3A%2F%2Fdevelopers.soundcloud.com%2Fcallback.html&response_type=code_and_token&scope=non-expiring&display=popup

Somehow the user has to see the connect screen, which is a login effectively.
The user-agent redirects to the given redirect url, which also contains the code and the token.
Maybe it is possible to call this endpoint directly with username/password and get back the non-expiring token.