Applications

Rotate an application's widget client_secret (new secret returned once)

Mints a fresh client_secret, stores only its hash, and returns the plaintext exactly once; it is never retrievable again. The old secret stops minting widget tokens (POST /tokens) immediately; already-issued widget JWTs run out their own short TTL. Admin-or-above (keys:manage): a member/viewer API key is rejected with 403.

post/applications/{id}/client-secret:rotate

Request

  • Base URL: https://api.customdomain.ai/v1
  • URL: https://api.customdomain.ai/v1/applications/{id}/client-secret:rotate
  • Auth: one of:
    • HTTP bearer
    • HTTP bearer

Path parameters

idstring required

Response

Rotated; the new client_secret is present only in this response

application_idstring required
client_secretstring required

sk_… (mints widget JWTs; shown once, stored hashed)

Changes

No recorded changes to this operation across all 1 revision of this API.