Hide the app_id / app_secret once it's generated
The app_id and / or app_secret don't need to be shown again once generated, since you should simply copy / paste them once where they should be used. If the client loses the credentials, the user should simply create a new app.
It's the way the Nextcloud app passwords work for instance.