---
title: "Regenerate client secret"
method: POST
path: "/oauth-clients/{appId}/regenerate-secret"
tags: ["OAuth Apps"]
---

# Regenerate client secret

`POST /oauth-clients/{appId}/regenerate-secret`

Generates a fresh client secret for an OAuth app. The previous secret is invalidated immediately — any client still presenting it will fail token exchange at `POST /oauth2/token` until updated.

The new secret is returned in this response **only** and cannot be retrieved later. Pair this call with credential propagation to every integration that uses the app. If the rotation was triggered by a suspected leak, also call `POST /oauth-clients/{appId}/revoke-all-tokens` to invalidate already-issued access and refresh tokens instead of waiting for their natural expiry.

Creator-only: even org admins cannot rotate secrets for other users' apps.

## Path parameters

- `appId` string, required

## Response `200`

New client secret generated

- RegenerateOAuthAppSecretResponse — Response body for `POST /oauth-clients/{appId}/regenerate-secret` (`regenerateSecret`).
  - `message` string, required
  - `clientId` string, required — OAuth client ID (unchanged)
  - `clientSecret` string, required — New client secret (store securely; previous secret is invalidated)

## Other responses

- `401` — Unauthorized
- `403` — Forbidden — caller cannot access this OAuth app (creator-only; see OAuth Apps tag).
- `404` — OAuth app not found or not visible to this caller (each user only sees apps they created)
- `429` — Rate limit exceeded

---

[API](https://skmtc.net/pipeshub-ai/apis/pipeshub-api.md) · [All operations](https://skmtc.net/pipeshub-ai/apis/pipeshub-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/pipeshub-ai/pipeshub-api/revisions/abd27cfefc73/schema)