---
title: "Rotate a service account's OAuth client secret"
method: POST
path: "/admin/service-accounts/{service_account_id}/rotate-secret"
tags: ["Service Accounts"]
---

# Rotate a service account's OAuth client secret

`POST /admin/service-accounts/{service_account_id}/rotate-secret`

## Request

- Base URL: `https://api.pinecone.io`
- URL: `https://api.pinecone.io/admin/service-accounts/{service_account_id}/rotate-secret`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/pinecone/apis/pinecone-admin-api/docs/admin/service-accounts/:service_account_id/rotate-secret/post.ts> (a function with typed inputs; its response is checked against the schema)

Rotate a service account's OAuth client secret; the previous secret and its tokens are revoked within seconds and the new secret is returned only once.

## Path parameters

- `service_account_id` string, uuid, required

## Headers

- `X-Pinecone-Api-Version` string, required

## Response `200`

Secret rotated successfully. The new `client_secret` is in the response body and is returned exactly once. Repeating the request rotates again and invalidates the previously returned secret.

- ServiceAccountWithSecret: A service account with a newly issued OAuth `client_secret`. The secret is returned only once and cannot be retrieved later.
  - `service_account` ServiceAccount, required: A service account. The OAuth `client_secret` is not included.
    - `id` string, uuid, required: The unique identifier for the service account. Use this as the path parameter on `/admin/service-accounts/{service_account_id}` endpoints and as the `principal_id` when querying or creating role bindings.
    - `name` string, required: A short human-readable label, set by the caller at creation time.
    - `client_id` string, required: The OAuth client ID used by the service account to obtain access tokens. Used only for OAuth token exchange.
    - `created_at` string, date-time, required: The date and time the service account was created.
    - `updated_at` string, date-time, required: The date and time of the service account's most recent metadata update.
  - `client_secret` string, required: The OAuth client secret. Returned exactly once. Treat this value as a credential — store it securely and never log it.

## Other responses

- `401`: Unauthorized. Possible causes: Invalid API key.
- `403`: Forbidden
- `404`: Not found
- `500`: Internal server error.
- `4XX`: Unexpected error on request.

---

[API](https://skmtc.dev/pinecone/apis/pinecone-admin-api.md) - [All operations](https://skmtc.dev/pinecone/apis/pinecone-admin-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pinecone/apis/pinecone-admin-api/revisions/8210e9d414c2?raw)