Based on your question, it seems you are developing either a browser-based front-end or a mobile application. Could you confirm which type of application you're working on?

If it’s a browser-based front-end or mobile application, these are considered OAuth2 public clients, and you should avoid using a client secret. Asgardeo supports public clients by issuing tokens without needing a client secret. You can configure this by selecting the "public client" option for the application you created in Asgardeo or simply picking single-page application template. The client_id is used only as an identifier, so it’s safe to use.

If you take this route, I highly recommend enabling the PKCE (Proof Key for Code Exchange) extension to mitigate risks associated with public clients. You can enable PKCE in the Asgardeo console for your application. Asgardeo SDKs, such as the Asgardeo React SDK, automatically implement security measures like PKCE, so you won’t have to worry about manually handling it.

That said, as per security best practices, the most secure option would be to handle OAuth2 flows on the server side using the Backend for Frontend (BFF) pattern, where both the client_id and client_secret can be securely stored in the server-side component.