I am looking to rotate the client secret for our OAuth app, I can’t find an option under the app to do this. I can see revoke and add key but I am worried that revoke isn’t a rotation and will result in needing to add a new client which would lead to a breaking change.
Is there a way to do this that I have maybe missed?
~ Jon
Hi Jon,
Our recommendation is to create new keys, update your environment variable and test. After you are done with testing the new key, you can go ahead and revoke the old ones.
If I make a new key would that generate a new client id as well? We are keen to avoid this as it would be a breaking change for a lot of users as from what I remember you can’t replace a client id but you can replace a secret and the credential will continue to work.
~ Jon
Hi Jon,
You’re right. Adding a new key issues a new client ID along with the new secret, and there isn’t currently a way to rotate only the secret. Any users authorized under the old key will need to reauthorize under the new one. The good news is you can make that transition gradual rather than breaking.
If you’re rotating as a precaution: Add a new key and use it for all new authorizations going forward. Keep using your existing key to refresh tokens for current users. It stays valid until you revoke it. Then move existing users through the authorization flow with the new key, for example the next time they log in to your system. Once everyone has moved over, revoke the old key.
If you’re responding to a suspected compromise: Add a new key, switch to it, and revoke the old one right away so nobody can make calls under your authorization. Your users will need to reauthorize before their integrations resume.
Hope that helps. Let me know if you have any questions about the transition.