# OmniAuth: What is exactly meant by secret or digest ? How to obtain it?

**URL:** <https://www.ruby-forum.com/t/omniauth-what-is-exactly-meant-by-secret-or-digest-how-to-obtain-it/261360>\
**Category:** Uncategorized\
**Created:** [May 26, 2021, 12:34pm UTC](https://www.ruby-forum.com/t/omniauth-what-is-exactly-meant-by-secret-or-digest-how-to-obtain-it/261360 "2021-05-26T12:34:29Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![von\_spotz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/e19adc/32.png) [@von\_spotz](https://www.ruby-forum.com/u/von_spotz)\
**Post date:** [May 26, 2021, 12:34pm UTC](https://www.ruby-forum.com/t/omniauth-what-is-exactly-meant-by-secret-or-digest-how-to-obtain-it/261360/1 "2021-05-26T12:34:29Z")

</div>

Hello,

OmniAuth uses “secrets” but the concept is nowhere explained. It’s obviously too trivial.

I guess it is, if you are once just being told what it means.

I also know some talk about a users “secret” in the context of Rails credentials. There is only a very short official Guide on it.

With OAuth, the concept is addressed for example here [RFC 6749 - The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749#page-71) in the RFC6749 or for further example here [RFC 6749 - The OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1)

```
client_id
     REQUIRED. The client identifier issued 
     to the client during the registration   
     process described by Section 2.2.

client_secret
     REQUIRED. The client secret. The      
     client MAY omit the parameter if the     
     client secret is an empty string.

```

How do I obtain that part of a users credentials or how do I generate a valid secret?

Is by “secret” the same thing meant as by “digest” ?

Also I have read about “server-side secrets” and “client-side secrets” I think.

I am new to security concepts, also in Rails.

Thanks!