How to handle client secrets for a CLI app?

[kdb13]

I am currently developing a CLI tool completely in Bash which will utilize the Trakt API. I would like to know how I should handle the client secrets (Client ID and Client Secret) in this script.

I've thought of two approaches:

1. The user should create the client app and pass the secrets (Multiple pairs client secrets)
2. There is a single client app, and the user should only authorize (Single pair of client secrets)

1. User is responsible for providing the secrets

This approach is already being used by this project which is a CLI tool written in Go. It asks the user to create a Trakt app and then provide the client secrets.

2. User just authorizes

In this approach, there is only a single Trakt app which is created by the developer (i.e. me) who is responsible for maintaining these secrets. With this approach, the problem lies in the fact that how do we manage these credentials in our Bash script.

I mean the script will be publicly visible (and so our credentials).

I would like to know everybody's opinion on which approach I should use and the pros and cons for each of them.

[kdb13]

I just found that Trakt API supports the PKCE workflow and I'll try to authenticate using that flow which doesn't require any client secret to be maintained and hence the no. 2 way is possible.

I am still open to any suggestions if any better approach is possible.