Why do you PASSPORT_PERSONAL_ACCESS_CLIENT_SECRET?

You need them to create personal access token and define which oauth client is used for it. You can create multiple personal access clients. If you don't set the envs, passport is going to use the first personal access client.

The ClientRepository is registered in the PassportServiceProvider in the package, which takes the values from the config: https://github.com/laravel/passport/blob/e543cf751b97b14e16167a550a6ab763070f3f91/src/PassportServiceProvider.php#L278

Here there client is resolved: https://github.com/laravel/passport/blob/e543cf751b97b14e16167a550a6ab763070f3f91/src/ClientRepository.php#L113

For easy readability:

public function personalAccessClient()
    {
        if ($this->personalAccessClientId) {
            return $this->find($this->personalAccessClientId);
        }

        $client = Passport::personalAccessClient();

        if (! $client->exists()) {
            throw new RuntimeException('Personal access client not found. Please create one.');
        }

        return $client->orderBy($client->getKeyName(), 'desc')->first()->client;
    }