title: What is a Cognito App Client Secret
body: <p>At the <a href="http://docs.aws.amazon.com/cognito/latest/developerguide/user-pool-settings-client-apps.html" rel="noreferrer">documentations</a> there's an <code>App Client Secret</code>, but I can't find anywhere its purpose. </p>
  
  <p>I see the javascript SDK doesn't use it, I also don't know why, probably because many javascript applications run on the users browser, not a place to expose a secret, but that's my wild guess. </p>
  
  <p>If this is something like a password for the <code>App Client ID</code>, I can't see how this improves security, since however can steal your <code>App Client ID</code> will be able to steal the <code>App Client Secret</code> as well. Besides, the <code>App Client ID</code> is fairly random and should provide enough security to brute-force attacks. </p>
  
  <p><strong>I would like to know what's the purpose of this secret, how cognito uses it and what functionalities does it provides.</strong></p>