client_secret is optional