clientSecret needed to be just secret