This is the wrong place to mention these params.  They are not actually sent in the above mentioned `POST https://SHOP_NAME.myshopify.com/admin/oauth/access_token` request, they are parameters to the `session.request_token(params)` method call described below.  Notice how client_id and client_secret are mentioned here, but don't relate the the session.request_token method.