expose client secret verification