Rotating our client secret

Develop, Build & Integrate APIs & Integrations
1

Hello there!

For a couple of apps we have, we’d like to know if and how can we rotate the client secrets?

This is simply for security’s good practice: some of those secrets were in our code base but we moved them to a managed solution. We’d like to rotate them so the “old” code base references are not usable.

Let me know!

2

Hi @DashThisDev :waving_hand:

I’m an app developer myself and, as far as I’m aware, it’s not possible to periodically or programmatically refresh HubSpot public app client secrets. These are static values that are uniquely assigned at the time of public app creation. In saying that, a HubSpot rep may be able to help you by manually updating your app’s OAuth credentials, as per the accepted answer on this post.

Aside from that, I think the best we can do currently is to avoid exposing OAuth-related credentials directly within source code.

I hope that proves helpful.

3

Hi Zach!

Thanks for the answer :slightly_smiling_face: This is what I figured. We had the secret in our codebase at some point, but moved it to a manager solution afterwards. We just didn’t rotate it since so I was hoping to do that now!