This is a feature request but I'm not sure I got the right repo. If I have time i'll put a pull request in as the little hack I have seems to work.
Basically in swagger-oauth.js adding the line clientSecret = (o.clientSecret||errors.push('missing client secret')); or something to that effect in the initOAuth() function and then 'client_secret': clientSecret, to the params in the processOAuthCode() function should allow client secret to pass to the oauth server's token endpoint.
The current github and google api just to name two require it. But I imagine it should be optional as its not part of the oauth spec. Thanks !