client-secret is returned masked: the first 2 and last 2 characters, with asterisks between. A secret of 8 characters or fewer is all asterisks. Send include-secret=yes to get the whole value; that read is recorded in the access log. client-secret-set says whether a secret is stored.{
"client-id": "app.example.com",
"client-secret": "ab****************************89",
"client-secret-set": "yes",
"redirect-uri": "https://app.example.com/oauth/callback"
}