I have a web site that requires user to log in by providing their email and password to gain access token, where the access token token is used to access api.

User can then gain access to read/write with the scope provided by the access token.

So, what I would like to understand here is that what roles does client id and client secret play in such a case, and what benefits can implement client id and client secret provide? Because i really do not see the need of implementing client id and client secret since user may just use access token to gain access right.