note about client id and secret