Why do we need the clientId when we already have just id in RegisteredClient object and why do we need to have a clientSecret? It’s counterintuitive to me because in the real world apps nobody asks to come up with more and more passwords for each of the user’s devices. Are they only needed for client_credentials grant type? How are the clientId and clientSecret usually dealt with in the real world apps?
The client id and client secret is for as the name suggests, the client.
You are not the client, you are the user, or end user. If i have your username and password i can claim to be you.
If i have the client id and client password, i can claim to be the program/server that gets to talk to the server that authenticates you.
We dont want any server/program to be allowed to talk to the authentication server.
So its not YOU that needs to remember this, its your server that needs it.
The clientId and clientSecret are not related to the user being authenticated.
They are to allow a server to use an external authentication service.
It is therefore not an additional password for a user. In fact the use of the authentication service allows the use of the same credentials on more applications.