---
title: "Rotate the client secret of the given OAuth application"
method: POST
path: "/oauth_applications/{oauth_application_id}/rotate_secret"
tags: ["OAuth Applications"]
---

# Rotate the client secret of the given OAuth application

`POST /oauth_applications/{oauth_application_id}/rotate_secret`

## Request

- Base URL: `https://api.clerk.com/v1`
- URL: `https://api.clerk.com/v1/oauth_applications/{oauth_application_id}/rotate_secret`
- Auth: HTTP bearer

Rotates the OAuth application's client secret.
When the client secret is rotated, make sure to update it in authorized OAuth clients.

## Path parameters

- `oauth_application_id` string, required

## Response `200`

An OAuth application with client secret

- OAuthApplicationWithSecret
  - `object` 'oauth_application', required
  - `id` string, required
  - `instance_id` string, required
  - `name` string, required
  - `client_id` string, required
  - `client_uri` string, nullable, required
  - `client_image_url` string, nullable, required
  - `dynamically_registered` boolean, required
  - `consent_screen_enabled` boolean, required
  - `pkce_required` boolean, required
  - `audience_uri` string, nullable, required: The active application audience URI, whose registry identity is permanently reserved to this application.
  - `token_exchange_enabled` boolean, required: Whether this confidential application accepts token exchanges from its active audience.
  - `device_authorization_grant_enabled` boolean, required
  - `public` boolean, required
  - `scopes` string, required: The complete scope ceiling for the OAuth application, as a space-delimited list of built-in and assigned custom scope keys.
  - `redirect_uris` string[], required
  - `callback_url` string, required: Deprecated: Use redirect_uris instead.
  - `authorize_url` string, required
  - `token_fetch_url` string, required
  - `user_info_url` string, required
  - `discovery_url` string, required
  - `token_introspection_url` string, required
  - `created_at` integer, required: Unix timestamp of creation.
  - `updated_at` integer, required: Unix timestamp of last update.
  - `client_secret` string: Empty if public client.

## Other responses

- `403`: Authorization invalid
- `404`: Resource not found

## Changes

- **2026-10-16** (2025-11-10) `7db12d6a9b2a`: 2 info
  - added the required property `allOf[#/components/schemas/OAuthApplication]/audience_uri` to the response with the `200` status
  - added the required property `allOf[#/components/schemas/OAuthApplication]/token_exchange_enabled` to the response with the `200` status
- **2026-09-09** (2025-11-10) `b5f30169c3f3`: 1 info
  - added the required property `allOf[#/components/schemas/OAuthApplication]/device_authorization_grant_enabled` to the response with the `200` status

[Operation history](https://skmtc.dev/clerk/apis/clerk-backend-api/changes/oauth_applications/:oauth_application_id/rotate_secret/post.md)

---

[API](https://skmtc.dev/clerk/apis/clerk-backend-api.md) - [All operations](https://skmtc.dev/clerk/apis/clerk-backend-api/llms.txt) - [OpenAPI document](https://skmtc.dev/clerk/apis/clerk-backend-api/revisions/a490313abffa?raw)