Rotate App Secret

Developer Support APIs & Integrations
1

Hi there,

I need to rotate my app’s secrets for security reasons.

What happens to refresh tokens when this is done?

E.g. if I have an existing refresh token and use the new secret - would it still work?

Thank you,

2

Hi @Andrey2,

Rotating the client secret does not invalidate existing refresh tokens, but all future token exchanges must use the new client secret.

Here’s how it works in HubSpot’s OAuth flow:

  1. Refresh tokens remain valid
    Refresh tokens are associated with the authorization grant given between a user and an application, rather than being tied directly to a client’s secret. Therefore, if a client rotates the client’s secret, it will not revoke any refresh tokens that have previously been provided to users.
  2. Token exchanges must use the new secret
    Once the secret is rotated, every request to /oauth/v1/token (including refresh token exchanges) must use the new client secret. Requests using the old secret will fail authentication.
  3. Deployment consideration for production integrations
    If your integration automatically refreshes tokens, make sure the updated client secret is deployed everywhere the refresh request is executed before the rotation takes effect.

Recommended approach

  • Rotate the client secret
  • Update the secret in your integration configuration
  • Immediately test a refresh token exchange

This ensures existing installations of your app continue working without requiring reauthorization.
Moderator note: While this solution may not address the original poster’s specific situation, it could be helpful for other community members facing similar challenges.

3

Thanks for the reply - that all sounds good.

So now I need to get someone from Hubspot to rotate the secret. I don’t see any way to do it myself.

4

Hi @Andrey2 and welcome, it’s a pleasure to have you here!
Thanks for reaching out to the HubSpot Community!
Just to clarify, when you rotate your app’s client secret in HubSpot, your existing refresh tokens are not invalidated. They continue to work as long as you:

- Keep using the same app (client ID), and
- Update your integration to use the **new client secret** when calling the `/oauth/v3/token` (or `/oauth/v1/token`) endpoint with your existing refresh tokens.

Using the old secret will cause the refresh request to fail, but rotating the secret alone does not revoke or expire your current refresh tokens.
Here are some resources that might be helpful:
- Manage OAuth access tokens using the v3 APIs
- OAuth Quickstart Guide
That said to rotate your app secret you can do so by contacting our Support Team, they’ll be able to help.
I hope that you’ll get sorted soon!
Thanks so much and have a lovely day!
Bérangère
This post was created with the assistance of AI tools

5

Hi BérangèreL,

Thanks for that info!

Okay, I’m ready to rotate the secret.

I’m trying to contact support, but my company has recently downgraded from starter - so it says I can only contact via the community.

Do you know if there’s anyone I can message?

Thank you!

6

Hi @Andrey2 and thanks for getting back to us!
I have just sent you a DM with the next steps.
Thanks and have a wonderful day! :sun_with_face:
Bérangère

7

Refresh tokens will keep working after the secret is rotated. They are tied to the app authorization, not the client secret.

The only change is that every token refresh request must use the new client secret. Requests using the old secret will fail.

So you don’t need users to reauthorize. Just update the secret in your integration before making the next /oauth/token refresh call.