Requests fail if client secret isn't added when using the javascript sdk

I'm implementing the pkce flow correctly, I'm creating a dropbox object and adding the app key and refresh token, but when trying to use the check app method it will throw an exception with the error "Error in call to API function "check/app": Invalid authorization value in HTTP header/URL parameter", adding the app secret will solve this issue but I can't do that because I have to ship my app to the user, trying the same app key and refresh token in the c# sdk works and according to posts on the forum this should also work with the javascript sdk, here is my code:

const auth = new DropboxAuth();
auth.setRefreshToken("xxxxx");
auth.setClientId("xxxxx");
// auth.setClientSecret("xxxxx");
const dbx = new Dropbox({auth: auth});
try {
    const res = await dbx.checkApp({ query: "test" });
    console.log(res);
} catch (e) {
    console.log(e);
}