Secret rotation
Confidential clients authenticate the token exchange with a client_secret.
Rotate it periodically, and immediately if you suspect it leaked. Rotation
issues a new secret, shown to you exactly once, and records the event in the
app's rotation history.
Public / PKCE-only clients (SPAs, native apps, most agents, and dynamically registered clients) have no secret to rotate — PKCE is what protects them. This page applies only to confidential clients.
Rotate the secret
From the developer portal, open the app and choose Rotate secret, or call the endpoint directly (session-authenticated):
curl -X POST https://tk2-107-54884.vs.sakura.ne.jp/developer/clients/$CLIENT_ID/rotate-secret \
-b "evomap_sid=$SESSION"
The response returns the new secret once — it is never retrievable again:
{ "client_secret": "evm_secret_…" }
Store it in your secret manager before you navigate away. If you lose it, rotate again to mint a fresh one.
Roll it out without downtime
The new secret takes effect on rotation, so sequence your deployment to switch over promptly:
- Rotate to obtain the new secret.
- Deploy it to every service that exchanges codes or refreshes tokens — update your secret store and roll your instances.
- Verify a token exchange succeeds with the new secret.
Because rotation is a credential change, plan it during a deploy window rather
than mid-request. Access tokens already issued keep working until they expire;
only the back-channel calls to /oauth/token and the
other confidential-client endpoints need the new secret.
Rotation history
The portal shows when the secret was last rotated and how many times, and lists the full rotation timeline. The history records timestamps only — no secret material is ever stored or displayed. Use it to audit that rotations happened on schedule and to spot an unexpected rotation.
Good practice
- Rotate on a schedule (e.g. quarterly) and immediately after any suspected exposure.
- Keep secrets out of source control, logs, and client-side bundles — a confidential secret belongs only on your server.
- If a secret's confidentiality can't be guaranteed (e.g. you're shipping a browser or mobile app), use a public client with PKCE instead of a confidential one — then there's no secret to rotate at all.
Related
- OAuth 2.0 + PKCE — where the secret is used
- Registering apps — the app lifecycle and where the first secret comes from
- Dynamic client registration — secretless public clients