Hello Hao,
Thank you for asking.
Yes, Client ID and Secret are requirements for getting OAuth2 access token.