client_secret must not be exposed, the SDK supports a proxy mode:
Proxy
JavaScript SDK — Proxy
Route SDK traffic through your own server
For browser apps where the
Route SDK traffic through your own server
client_secret must not be exposed, the SDK supports a proxy mode: