For statically-configured public clients it should be allowed for both Secret and SecretEnv fields to be empty.