Rotating Client Secret Key
- Yashna Chhatwal (Unlicensed)
- Ajay Sharma
This feature allows you to generate a new secret key in case your API credentials have been exposed.
API credentials should be changed regularly:
employees leave
API credentials can be accidentally committed to version control
Wide-reaching security flaws can be discovered
While these situations pose security risks, they can be handled by rotating API credentials of your APP.
Before you start
You should have a configured app.
How it works
Login into the partner dashboard.
Go to App. All your created apps will be visible on this page.
Select the app.
You will be directed to App Settings page.
Click on app information tab.
In app credentials section, click on Generate new secret.
If your app uses webhooks, then configure it to accept both webhooks signed with the new secret key and webhooks signed with the old secret key until after you revoke the old secret.
Configure your app to use only the new secret key for OAuth Authentication.
Create new access tokens.
Revoke the old secret key.
In the case of a serious security breach, you should immediately revoke your compromised API credentials before you generate new ones.
