diff --git a/internal/util/client.go b/internal/util/client.go
new file mode 100644
index 0000000..df67742
--- /dev/null
+++ b/internal/util/client.go
@@ -0,0 +1,9 @@
+package util
+
+func GenerateClientID() (string, error) {
+	return generateRandomStringURLSafe(16)
+}
+
+func GenerateClientSecret() (string, error) {
+	return generateRandomStringURLSafe(32)
+}
diff --git a/internal/util/generate.go b/internal/util/generate.go
new file mode 100644
index 0000000..ca1eb8b
--- /dev/null
+++ b/internal/util/generate.go
@@ -0,0 +1,17 @@
+package util
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"fmt"
+)
+
+// generateRandomStringURLSafe generates a base64 URL-safe random string of n bytes.
+func generateRandomStringURLSafe(n int) (string, error) {
+	bytes := make([]byte, n)
+	_, err := rand.Read(bytes)
+	if err != nil {
+		return "", fmt.Errorf("failed to generate random bytes: %w", err)
+	}
+	return base64.RawURLEncoding.EncodeToString(bytes), nil
+}