diff --git a/.github/workflows/odh_notebook_controller_integration_test.yaml b/.github/workflows/odh_notebook_controller_integration_test.yaml
index 3d451d0a33e..9db6b55879f 100644
--- a/.github/workflows/odh_notebook_controller_integration_test.yaml
+++ b/.github/workflows/odh_notebook_controller_integration_test.yaml
@@ -222,6 +222,32 @@ jobs:
           kubectl describe pods -n opendatahub -l app=odh-notebook-controller
           kubectl logs -n opendatahub -l app=odh-notebook-controller
 
+      - name: Create oauth secrets, rhods-operator would've generated that when it sees the notebook (created in the next step), but we test without rhods-operator
+        run: |
+          notebookNamespace=default
+          notebookName=minimal-notebook
+
+          cat <<EOF | kubectl apply -f -
+          ---
+          kind: Secret
+          apiVersion: v1
+          metadata:
+            name: ${notebookName}-oauth-client-generated
+            namespace: ${notebookNamespace}
+          stringData:
+            secret: EXAMPLE_SECRET_xyz
+          type: Opaque
+          ---
+          kind: Secret
+          apiVersion: v1
+          metadata:
+            name: ${notebookName}-oauth-config-generated
+            namespace: ${notebookNamespace}
+          stringData:
+            cookie_secret: EXAMPLE_COOKIE_SECRET_x
+          type: Opaque
+          EOF
+
       - name: Create notebook and check it, this is from kubeflow readme
         run: |
           notebook_namespace=default
diff --git a/components/odh-notebook-controller/controllers/notebook_controller_test.go b/components/odh-notebook-controller/controllers/notebook_controller_test.go
index 817ed7aa614..ff8ad0984c4 100644
--- a/components/odh-notebook-controller/controllers/notebook_controller_test.go
+++ b/components/odh-notebook-controller/controllers/notebook_controller_test.go
@@ -642,7 +642,16 @@ var _ = Describe("The Openshift Notebook controller", func() {
 								VolumeSource: corev1.VolumeSource{
 									Secret: &corev1.SecretVolumeSource{
 										SecretName:  Name + "-oauth-config",
-										DefaultMode: pointer.Int32Ptr(420),
+										DefaultMode: pointer.Int32(420),
+									},
+								},
+							},
+							{
+								Name: "oauth-client",
+								VolumeSource: corev1.VolumeSource{
+									Secret: &corev1.SecretVolumeSource{
+										SecretName:  Name + "-oauth-client-generated",
+										DefaultMode: pointer.Int32(420),
 									},
 								},
 							},
@@ -1027,6 +1036,9 @@ func createOAuthContainer(name, namespace string) corev1.Container {
 			"--upstream-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt",
 			"--email-domain=*",
 			"--skip-provider-button",
+			`--client-id=` + name + `-oauth-client`,
+			"--client-secret-file=/etc/oauth/client/secret",
+			"--scope=user:info user:check-access",
 			`--openshift-sar={"verb":"get","resource":"notebooks","resourceAPIGroup":"kubeflow.org",` +
 				`"resourceName":"` + name + `","namespace":"$(NAMESPACE)"}`,
 			"--logout-url=https://example.notebook-url/notebook/" + namespace + "/" + name,
@@ -1075,6 +1087,10 @@ func createOAuthContainer(name, namespace string) corev1.Container {
 			},
 		},
 		VolumeMounts: []corev1.VolumeMount{
+			{
+				Name:      "oauth-client",
+				MountPath: "/etc/oauth/client",
+			},
 			{
 				Name:      "oauth-config",
 				MountPath: "/etc/oauth/config",
diff --git a/components/odh-notebook-controller/controllers/notebook_oauth.go b/components/odh-notebook-controller/controllers/notebook_oauth.go
index 81f78f94a5a..7577e530ddb 100644
--- a/components/odh-notebook-controller/controllers/notebook_oauth.go
+++ b/components/odh-notebook-controller/controllers/notebook_oauth.go
@@ -209,6 +209,26 @@ func NewNotebookOAuthSecret(notebook *nbv1.Notebook) *corev1.Secret {
 	}
 }
 
+// NewNotebookOAuthClientSecret defines the desired OAuth client secret object
+func NewNotebookOAuthClientSecret(notebook *nbv1.Notebook) *corev1.Secret {
+	// Generate the client secret for the OAuth proxy
+	return &corev1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      notebook.Name + "-oauth-client",
+			Namespace: notebook.Namespace,
+			Labels: map[string]string{
+				"notebook-name": notebook.Name,
+			},
+			Annotations: map[string]string{
+				"secret-generator.opendatahub.io/name":               "secret",
+				"secret-generator.opendatahub.io/type":               "random",
+				"secret-generator.opendatahub.io/complexity":         "32",
+				"secret-generator.opendatahub.io/oauth-client-route": notebook.Name,
+			},
+		},
+	}
+}
+
 // ReconcileOAuthSecret will manage the OAuth secret reconciliation required by
 // the notebook OAuth proxy
 func (r *OpenshiftNotebookReconciler) ReconcileOAuthSecret(notebook *nbv1.Notebook, ctx context.Context) error {
@@ -246,6 +266,36 @@ func (r *OpenshiftNotebookReconciler) ReconcileOAuthSecret(notebook *nbv1.Notebo
 		}
 	}
 
+	// Generate the desired OAuth client secret
+	desiredClientSecret := NewNotebookOAuthClientSecret(notebook)
+	// Create the OAuth client secret if it does not already exist
+	foundClientSecret := &corev1.Secret{}
+	err = r.Get(ctx, types.NamespacedName{
+		Name:      desiredClientSecret.Name,
+		Namespace: notebook.Namespace,
+	}, foundClientSecret)
+	if err != nil {
+		if apierrs.IsNotFound(err) {
+			log.Info("Creating OAuth Client Secret")
+			// Add .metatada.ownerReferences to the OAuth client secret to be deleted by
+			// the Kubernetes garbage collector if the notebook is deleted
+			err = ctrl.SetControllerReference(notebook, desiredClientSecret, r.Scheme)
+			if err != nil {
+				log.Error(err, "Unable to add OwnerReference to the OAuth Client Secret")
+				return err
+			}
+			// Create the OAuth client secret in the Openshift cluster
+			err = r.Create(ctx, desiredClientSecret)
+			if err != nil && !apierrs.IsAlreadyExists(err) {
+				log.Error(err, "Unable to create the OAuth Client Secret")
+				return err
+			}
+		} else {
+			log.Error(err, "Unable to fetch the OAuth Client Secret")
+			return err
+		}
+	}
+
 	return nil
 }
 
diff --git a/components/odh-notebook-controller/controllers/notebook_webhook.go b/components/odh-notebook-controller/controllers/notebook_webhook.go
index 0f3163bd758..5f2cfe9c5d4 100644
--- a/components/odh-notebook-controller/controllers/notebook_webhook.go
+++ b/components/odh-notebook-controller/controllers/notebook_webhook.go
@@ -98,6 +98,9 @@ func InjectOAuthProxy(notebook *nbv1.Notebook, oauth OAuthConfig) error {
 			"--upstream-ca=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt",
 			"--email-domain=*",
 			"--skip-provider-button",
+			`--client-id=` + notebook.Name + `-oauth-client`,
+			"--client-secret-file=/etc/oauth/client/secret",
+			"--scope=user:info user:check-access",
 			`--openshift-sar={"verb":"get","resource":"notebooks","resourceAPIGroup":"kubeflow.org",` +
 				`"resourceName":"` + notebook.Name + `","namespace":"$(NAMESPACE)"}`,
 		},
@@ -145,6 +148,10 @@ func InjectOAuthProxy(notebook *nbv1.Notebook, oauth OAuthConfig) error {
 			},
 		},
 		VolumeMounts: []corev1.VolumeMount{
+			{
+				Name:      "oauth-client",
+				MountPath: "/etc/oauth/client",
+			},
 			{
 				Name:      "oauth-config",
 				MountPath: "/etc/oauth/config",
@@ -200,6 +207,29 @@ func InjectOAuthProxy(notebook *nbv1.Notebook, oauth OAuthConfig) error {
 		*notebookVolumes = append(*notebookVolumes, oauthVolume)
 	}
 
+	// Add the OAuth Client configuration volume:
+	// https://pkg.go.dev/k8s.io/api/core/v1#Volume
+	clientVolumeExists := false
+	clientVolume := corev1.Volume{
+		Name: "oauth-client",
+		VolumeSource: corev1.VolumeSource{
+			Secret: &corev1.SecretVolumeSource{
+				SecretName:  notebook.Name + "-oauth-client-generated",
+				DefaultMode: pointer.Int32(420),
+			},
+		},
+	}
+	for index, volume := range *notebookVolumes {
+		if volume.Name == "oauth-client" {
+			(*notebookVolumes)[index] = clientVolume
+			clientVolumeExists = true
+			break
+		}
+	}
+	if !clientVolumeExists {
+		*notebookVolumes = append(*notebookVolumes, clientVolume)
+	}
+
 	// Add the TLS certificates volume:
 	// https://pkg.go.dev/k8s.io/api/core/v1#Volume
 	tlsVolumeExists := false