Short answer
HubSpot's developer docs: the client ID, client secret and redirect URLs are in the app's authentication settings, under Client credentials. The secret is confidential; rotate it if compromised. Privately distributed OAuth apps can be installed in up to 10 allowlisted accounts; marketplace apps before listing in up to 25.
1. Apps moved
In my demo portal, private apps now sit under Legacy Apps.

2. Not the same as a token
Private app and service key tokens are separate credentials. See service keys.