configuration client_id and client_secret can be empty