This I know. What keeps me employed is knowing how to construct a client that doesn't embed a secret yet manages to perform an authorization flow.