Generates a fresh client secret for an OAuth app. The previous secret is invalidated immediately — any client still presenting it will fail token exchange at POST /oauth2/token until updated.

The new secret is returned in this response only and cannot be retrieved later. Pair this call with credential propagation to every integration that uses the app. If the rotation was triggered by a suspected leak, also call POST /oauth-clients/{appId}/revoke-all-tokens to invalidate already-issued access and refresh tokens instead of waiting for their natural expiry.

Creator-only: even org admins cannot rotate secrets for other users' apps.

{
  "message": "Client secret regenerated successfully"
}