Bug Fix: the client secret is replaced by the refresh token