Turns out, our client needs to have Client authentication enabled:

then you will have a new tab credentials where you will see the client secret.