clientSecret

SDK app-registration secret. Required for the unique-id auth method (signInOrCreateMember, used by /auth/token and /auth/revoke). Not required for the authenticateWithTokens host-injected flow or for username/password (authenticateWithCredentials) members — consumers integrating only via those methods can omit this field. See class KDoc for the full matrix.

⚠️ Avoid embedding the secret in production mobile apps

A mobile app is a public client: a bundled secret can be extracted from the package, observed on a compromised device, or captured via proxy tooling. For production integrations, do not ship the Client Secret in the app. Instead have your backend perform the token exchange and hand the SDK the resulting pair via AFCore.authentication().authenticateWithTokens(...) — then build the config with clientId only (the SDK refreshes with clientId + refresh token, no secret required). Keep this setter for backend-only services, local development, and legacy tenants.