I'm building some functionality within one of my WordPress sites that integrates with a third-party API, and that API uses OAuth 2.0.
I use both the client ID and secret every time I need a new access token, which is going to be at least once a day as the access token expires after 24 hours. (Generating a new access token also generates a new refresh token, and the previous refresh token is invalidated.) I'm storing the tokens in the options table in the database, along with the expires_in time.
Where should I be storing my client ID and secret? Is there a typical place to store things like this within WordPress? Right now I just have them defined in the wp-config.php. While I'm thinking this should work well, are there any potential drawbacks to this method, particularly regarding security of the client secret?