Documentation/Developers
Back
  • Getting started
    • Frontends and app types
    • Environments and endpoints
  • OAuth clients
    • Client ID and secret
    • Redirect URIs and start URL
    • Secret rotation
  • Login with appsolut
    • Authorization code flow
    • Tokens and claims
    • Frontend role
    • Sign-out
    • Revocation and issued tokens
    • Token endpoint errors
  • Frontend keys
    • Issue and store a key
    • Send a key
    • Rotate and revoke
  • Members API
    • Eligibility from a backend
    • The signed-in member
    • Results, rate limits and errors
    • Is an applicant an eligible member?
    • The signed-in frontend user's membership
  • appsolut register API
    • Implement the API
    • Connect and test
    • Verify a member with their challenge code
    • List every member
    • The status of several members
    • The status of one member
    • The person data of several members
    • The person data of one member
    • The claims of several members
    • The claims of one member
    • Health check

Secret rotation

Rotating the client secret, and recreating a sign-in client that was lost.

Rotate the secret

On the frontend's "Sign-in" card, "Rotate secret" issues a new client secret and shows it once, in the dialog "Your new client secret".

There is no overlap. The old secret stops working at once, and every sign-in of your frontend fails until the new secret is deployed to its backend. Rotate only when you can deploy straight away:

  1. Prepare the deployment, so only the secret is missing.
  2. Have the secret rotated, and copy it from the dialog.
  3. Deploy it at once, then confirm with "I have stored the secret".

Rotation changes nothing else: the client ID, redirect URIs and start URL stay, and so do your users' sessions. Rotate when the secret may have leaked, when someone who knew it leaves, or when you lost it.

When the client is missing

If the frontend's sign-in client no longer exists on the Auth server, the card says "The sign-in client no longer exists", and frontend users cannot sign in. "Recreate client" creates a new one: it has a new client ID and a new secret, shown once in "Your frontend's new sign-in client". Deploy both to your backend at once; until then every sign-in fails. Refresh tokens of the old client no longer work, so your users sign in again.

When the client could not be set up

If the Auth server did not answer when the settings were first saved, the card says "This frontend has no sign-in client yet". The settings are saved; saving them again retries creating the client.

Who can do it

Studio users with the Studio role "Owner", "Administrator" or "Frontend manager".