Hi I noticed that you have the capability to assist with rotating the OAuth2 Client Secret here mannually. I am curious whether the authorized token and refresh token will become invalid after client secret rotate?
Additionally, I noticed that the client secret is also utilized in the token refresh flow and I was wondering if we could still utilize the previous client secret for token refreshing in short time?
Thank you
Hi @RayZM,
Thanks for reaching out to the Community!
I would like to invite some members of our community who may offer valuable insights.— hey @zach_threadint, @CHawkins, @DIntegration4 Could you share your advice for @RayZM?
Thanks for taking a look!
Diana
Hi @DianaGomez Thanks for your help
Why are you resetting this?
I’d suggest writing your integration to be using your new token as soon as you rotate it. And anytime someone authorizes, you would get the tokens. And if their tokens have expired, then you send them back through here to refresh the token.
I need to reset it due to the leak of the client secret.
However, I’m concerned that customers won’t be able to quickly refresh their access tokens using the refresh token when I replace the existing secret with a new one.
Moreover, we can’t ask our customers to reauthorize with a new client secret, as that would result in a poor user experience.
Do you have some advice?
okay -- so don’t stress this! This is simple (with me needing to confirm something with hubspot)
when you roll your new secret you will need to work with the person on when they are updating it so you can update any environment variables that are needed to be updated. You should push your changes at the same time if possible.
I would look to schedule the time with the person that changes it, send an email to users that there will be a down period of 30 minutes during this time.
when you push all the changes -- new authorization will use the new secret. Users already authorized will not refesh until their token expires or however you have that set up.
the one item we need to confirm is that HubSpot DOES NOT expire all authenticated tokens upon this update. If they do, then I would make sure this is done during off hours.
either way, in the end, if you have the app updated and your environment variables updated at roughly the same time you shouldn’t have any problems.
from the standpoint of your customers they shouldn’t really need to reauth unless hubspot expires everything. I don’t think that is something they would do.
sorry if this is all over the place I’m on my phone and the editing experience is less than wonderful.
the one thing you need to make sure is in your code, if a token is expired, 401 error -- then you redirect to the oauth url.
if your app is more background based, then as soon as that error happens, you need to email the user with the auth url so they can reauthorize the app. At this point we hope your app is using queues that retry. If not, I’d store the information into a table to be stored once the user re authorizes. If this needs to happen I can write some more details on next steps for you when I’m on my computer tomorrow
Hi @nickdeckerdevs1 Thanks for your professional answer. What’s more, could anyone please help confirm this. It’s important for us.
the one item we need to confirm is that HubSpot DOES NOT expire all authenticated tokens upon this update. If they do, then I would make sure this is done during off hours.