Rotating public app client secret

Develop, Build & Integrate APIs & Integrations
,
1

As it has been discussed on these threads:

https://community.hubspot.com/t5/APIs-Integrations/How-to-reset-client-secret/m-p/271360/highlight/true#M24554

https://community.hubspot.com/t5/APIs-Integrations/Help-on-Oauth2-Client-Secret-Rotation/m-p/1133322#M81462

https://community.hubspot.com/t5/APIs-Integrations/How-to-reset-client-secret/m-p/271208#M24533

it seems that is not possible for me to rotate the client secret of a public app by myself, but it’s possible for the HubSpot team to help with this.

First of all, I’m not sure on the specifics of what rotating the secret client will entail since it’s not publicly documented, there is this post here: https://community.hubspot.com/t5/APIs-Integrations/Help-on-Oauth2-Client-Secret-Rotation/m-p/1133884/highlight/true#M81484 but since the author is not from the HubSpot team I want to make sure of what will happen before going through with the rotation. I’ve got the following questions.

1. will the previous client secret be invalidated immediately when a new client secret is created?

2. is it possible to have the old and new client secrets to be valid at the same time?

3. given that the public app is in production, we already have many customer that have authenticated and we got their credentials, will these credentials be invalidated after the rotation? would we need to request the users to reauthenticate to the application?

4. will rotating the client secret generate any disruption on the webhooks the application receives from HubSpot?

Please let me know if you can help me with this.

Thanks in advance.

2

Hi @CarBelt and welcome, we are so glad to have you here!
Great questions, thanks for asking the HubSpot Community and thanks for taking the time to do some research before posting, I really appreciate!
Also, thanks for your feedback regarding the documentation, I’ll make sure to pass that along internally for you!
Here are some resources on the topic, just for information:
- Working with OAuth
- OAuth
I’d love to put you in touch with our Top Experts: Hi @nickdeckerdevs1, @sylvain_tirreau and @Anton do you have additional insights to share regarding @CarBelt’s questions, please?
Have a lovely day and thanks so much in advance for your valuable contributions!
Bérangère

3

Hello,

I think you should open a support ticket with Hubspot and ask them these questions (which I personally don’t have the answers to).

Best

4

Hi @CarBelt, I hope that you are well!
I recommend that you also share your thoughts on the HubSpot Developer Feedback form.
Thanks and have a great day!
Bérangère

5

Hello! We also need to rotate our app client secret. I have the same exact questions but no answers. I have tried contacting support but have been unable to. Could someone give more context here.

6

Hi @Anonymous,
Thank you for posting to the Community!
I’d like to tag in some of our Top Contributors to see if they have any suggestions on this.
Hi @deepikaverma @miljkovicmisa @WesQ I hope you all are having a great Wednesday!
Do you have any ideas on rotating a public app client secret for @Anonymous?
Cassie, Community Manager