How to keep client secret for OAuth2 login to Parse server secure?

I want to enable users in my macos app to be able to securely login to my Parse Server using third-party Oauth2 login. I have been searching for the best approach to do this, but still have some problems. If I understand correctly, logging in requires:

1. Enable oauth in my Parse server config file (for twitter, google etc).
2. Get the access token to the provider (e.g. twitter) using a client side OAuth login. I am currently using OAuthSwift.

3. Login to Parse using the provided access token (from 2) as suggested in the swift example provided here, i.e.

   [[PFUser logInWithAuthTypeInBackground:provider authData:authData] continueWithBlock:^id(BFTask<id> *task) {
    return task;
   }];
   

This login approach requires the use of the client key and client secret for each provider. How can I safely store these keys-secrets on my Parse server and access them programmatically? Should I use PFConfig and access them during runtime? Is that safe? Or is there something I am doing very wrong here? If anyone has a better approach or an example as to how I should enable OAuth login I would appreciate it (since I am on macos I can not use TwitterUtils and FacebookUtils).