Skip to main content
You can change an application’s using the or the Auth0 . When you rotate a client secret, you must update any authorized applications with the new value.
Client secrets should not be stored in public client applications. To learn more, read Confidential and Public Applications.
New secrets may be delayed up to thirty seconds while rotating. To minimize downtime, we suggest you store the new client secret in your application’s code/system configuration as a fallback to the previous secret. This way, if the client application request doesn’t work with the old secret, your app will use the new secret.Secrets can be stored in a list (or similar structure) until they’re no longer needed. Once you’re sure that an old secret is obsolete, you can remove its value from your app’s code.

​
Use the Dashboard

  1. In the Auth0 Dashboard, go to Applications > Applications, and then select the name of the application to view.
    Dashboard Applications List
  2. Scroll to the bottom of the Settings page, locate the Danger Zone, select Rotate, and confirm.
  3. Scroll to the top of the page, and switch to the Credentials tab.
  4. View your new secret by locating Client Secret, and selecting the eye icon.
    Dashboard Applications Application Settings Tab Basic Information
  5. Update authorized applications with the new value.

​
Use the Management API

  1. Call the Management API Rotate a client secret endpoint. Replace the YOUR_CLIENT_ID and MGMT_API_ACCESS_TOKEN placeholder values with your client ID and Management API access token, respectively. 
    curl --request POST \
  --url 'https://{yourDomain}/api/v2/clients/%7ByourClientId%7D/rotate-secret' \
  --header 'authorization: Bearer {yourMgmtApiAccessToken}'
    ValueDescription
    YOUR_CLIENT_IDΤhe ID of the application to be updated.
    MGMT_API_ACCESS_TOKENAccess Tokens for the Management API with the scope update:client_keys.
  2. Update authorized applications with the new value.

​
Set a custom client secret

You can use the Management API Update a client endpoint to to set a client secret manually instead of requesting a rotation to an automatically generated secret. Your application is configured with the future secret as a fallback ahead of the actual rotation. 
   curl --request PATCH \
   --url https://{TenantDomain}/api/v2/clients/{ClientID} \
   --header 'Authorization: Bearer {AccessToken}' \
   --header 'Content-Type: application/json' \
   --data '{
      "client_secret": "{CustomClientSecret}"
      }'

​
Learn more