okay -- so don’t stress this! This is simple (with me needing to confirm something with hubspot)
when you roll your new secret you will need to work with the person on when they are updating it so you can update any environment variables that are needed to be updated. You should push your changes at the same time if possible.
I would look to schedule the time with the person that changes it, send an email to users that there will be a down period of 30 minutes during this time.
when you push all the changes -- new authorization will use the new secret. Users already authorized will not refesh until their token expires or however you have that set up.
the one item we need to confirm is that HubSpot DOES NOT expire all authenticated tokens upon this update. If they do, then I would make sure this is done during off hours.
either way, in the end, if you have the app updated and your environment variables updated at roughly the same time you shouldn’t have any problems.
from the standpoint of your customers they shouldn’t really need to reauth unless hubspot expires everything. I don’t think that is something they would do.
sorry if this is all over the place I’m on my phone and the editing experience is less than wonderful.
the one thing you need to make sure is in your code, if a token is expired, 401 error -- then you redirect to the oauth url.
if your app is more background based, then as soon as that error happens, you need to email the user with the auth url so they can reauthorize the app. At this point we hope your app is using queues that retry. If not, I’d store the information into a table to be stored once the user re authorizes. If this needs to happen I can write some more details on next steps for you when I’m on my computer tomorrow