Is Secret necessary/safe when using OAuth2 provider like GitHub.

[feelixe]

I'm currently trying to learn OAuth2 but struggeling with some things.

I have a Nuxt.js project in frontend and a backend with a REST api.

I can sign in with Github using Nuxt/Auth. It works very well. But there's something I can't get my head around.

Is it safe to store the Secret Key in nuxt.config.js?

I assume yes since the docs say so but I cant understand why.
I'm guessing the Code to Access token request is only sent server side?
But what happens if config the nuxt app to have client side rendering? Won't the user be able to see the Secret in the request?