capabilities.work

Rotate a Client Secret

A 5-step recipe with Keycloak. We can help you get access.

Recipe · 5 steps

Rotate a Client Secret

with Keycloak · Identity & Access Management

Regenerate a confidential client's secret and confirm the new value.

  1. Exchange the clientId for the internal client UUID. The secret endpoints are keyed on the UUID, and this lookup is the only way to get it.
  2. Read the client representation to confirm it is confidential before rotating. A public client has no secret to rotate, so this step is the guard that keeps the flow from doing something meaningless.
  3. Record the secret that is about to be retired, so the operator can tell which value was replaced and confirm the rotation actually changed it.
  4. Issue a new client secret. This takes effect immediately and invalidates the previous value, so the application configuration must be updated with the new secret before its next token request.
  5. Read the stored secret back and assert it no longer matches the value captured before rotation, proving the new credential is the live one.
What you'll need to have ready
  • realm: The name of the realm the client is registered in.
  • clientId: The OAuth client identifier whose secret should be rotated.
For your developer

Arazzo workflow keycloak:rotate-client-secret, 5 operations: getClients → getClient → getClientSecret → regenerateClientSecret → getClientSecret. Specs on APIs.io.

More recipes with Keycloak

Assign a User to a GroupAudit Group MembershipAudit a User's Effective AccessDecommission a ClientFederate an Identity ProviderApply a Realm Security BaselineInventory a RealmOffboard a UserOnboard a UserProvision a Group Hierarchy