handle app secret in client instances