---
title: "Delete application legacy secret"
method: DELETE
path: "/api/applications/{id}/legacy-secret"
tags: ["Applications"]
---

# Delete application legacy secret

`DELETE /api/applications/{id}/legacy-secret`

Delete the legacy secret for the application and replace it with an internal secret used only by Logto. The internal secret is not returned by Management APIs and cannot be used for client authentication.

## Path parameters

- `id` string, required

## Response `200`

The legacy secret was deleted successfully.

- object
  - `tenantId` string, required
  - `id` string, required
  - `name` string, required
  - `secret` string
  - `description` string, nullable, required
  - `type` 'Native' | 'SPA' | 'Traditional' | 'MachineToMachine' | 'Protected' | 'SAML', required
  - `oidcClientMetadata` object, required
    - `redirectUris` object[], required
    - `postLogoutRedirectUris` object[], required
    - `backchannelLogoutUri` string, url
    - `backchannelLogoutSessionRequired` boolean
    - `logoUri` string
  - `customClientMetadata` object, required
    - `corsAllowedOrigins` string[]
    - `idTokenTtl` number
    - `refreshTokenTtl` number
    - `refreshTokenTtlInDays` number
    - `tenantId` string
    - `alwaysIssueRefreshToken` boolean
    - `rotateRefreshToken` boolean
    - `allowTokenExchange` boolean
    - `isDeviceFlow` boolean
    - `maxAllowedGrants` number
  - `protectedAppMetadata` object, nullable, required
    - `host` string, required
    - `origin` string, required
    - `sessionDuration` number, required
    - `pageRules` object[], required
      - `path` string, required
    - `additionalScopes` string[]
    - `customDomains` object[]
      - `domain` string, required
      - `status` 'PendingVerification' | 'PendingSsl' | 'Active' | 'Error', required
      - `errorMessage` string, nullable, required
      - `dnsRecords` object[], required
        - `name` string, required
        - `type` string, required
        - `value` string, required
      - `cloudflareData` object, nullable, required
        - `id` string, required
        - `status` string, required
        - `ssl` object, required
          - `status` string, required
          - `validation_errors` object[]
            - `message` string, required
        - `verification_errors` string[]
  - `customData` object, required — arbitrary
  - `isThirdParty` boolean, required
  - `appLevelAccessControlEnabled` boolean, required
  - `createdAt` number, required

## Other responses

- `400` — The application does not have a legacy secret.
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found

---

[API](https://skmtc.net/logto/apis/logto-api-references.md) · [All operations](https://skmtc.net/logto/apis/logto-api-references/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/logto/logto-api-references/versions/a163dc77d842/schema)