Exposing client_secret when only implicit grant is used

Hi,

"the /token/from_oauth1 API call, which however requires the client_secret (I don't understand why though)"

The /2/auth/token/from_oauth1 endpoint is an API v2 endpoint and isn't signed using the normal OAuth 1 protocol, but it does require all four token pieces (app key, app secret, access token key, access token secret) in order to maintain the same authentication requirements as an actual OAuth 1 call.

"I only use the implicit grant flow. Would there be any security implications if I exposed the client_secret in order to perform the from_oauth1 call client-side"

I can't offer general security advice, so if you have any security questions, you should contact a security professional. 

That said, you're correct that the app secret is used by the OAuth 2 "code" flow (and not the "token" a.k.a. "implicit" flow). With both the app key and secret, an attacker may be able to convince the user to give them an access token for their account and your app by using the "code" flow without a redirect URI.

The app secret is also used to sign webhook notifications.

"my app currently exposes the old API v1 "key" (there was no way avoiding that without using a third party server for authentication). Can the current client_secret be derived from this? "

No, the app secret cannot be derived from the app key. The app key is generally considered public, so it's ok to expose it.

Hope this helps!