---
title: "Regenerate client secret"
method: POST
path: "/oauth-clients/{appId}/regenerate-secret"
tags: ["OAuth Apps"]
---

# Regenerate client secret

`POST /oauth-clients/{appId}/regenerate-secret`

## Request

- Base URL: `https://app.pipeshub.com/api/v1`
- URL: `https://app.pipeshub.com/api/v1/oauth-clients/{appId}/regenerate-secret`
- Auth: HTTP bearer

Generates a fresh client secret for an OAuth app. The previous secret is invalidated immediately — any client still presenting it will fail token exchange at `POST /oauth2/token` until updated.

The new secret is returned in this response **only** and cannot be retrieved later. Pair this call with credential propagation to every integration that uses the app. If the rotation was triggered by a suspected leak, also call `POST /oauth-clients/{appId}/revoke-all-tokens` to invalidate already-issued access and refresh tokens instead of waiting for their natural expiry.

Creator-only: even org admins cannot rotate secrets for other users' apps.

## Path parameters

- `appId` string, required

## Response `200`

New client secret generated

- RegenerateOAuthAppSecretResponse: Response body for `POST /oauth-clients/{appId}/regenerate-secret` (`regenerateSecret`).
  - `message` string, required
  - `clientId` string, required: OAuth client ID (unchanged)
  - `clientSecret` string, required: New client secret (store securely; previous secret is invalidated)

## Other responses

- `400`: `appId` is not a 24-character hex id (`VALIDATION_ERROR` naming `params.appId`) Also returned, before authentication, when a query value, or any string in a JSON or form-encoded body, looks like markup to the app-wide XSS filter: an HTML tag, a script tag, `<iframe`, `<object`, `<embed` or `<svg` tag, a word starting with `on` followed by `=` (meant for inline event handlers such as `onerror=`, it also catches plain text such as `one=1`), a `javascript:` or `data:text/html` URL, an encoded script tag (`&lt;script`, `%3cscript`), or any string longer than 100,000 characters (`HTTP_BAD_REQUEST`, "HTML tags, scripts, and XSS content are not allowed in ...", naming the field or query parameter; a string over 100,000 characters is refused as too long instead). A JSON body that does not parse is refused the same way, also before authentication (`HTTP_BAD_REQUEST`, "The request body is not valid JSON.").
- `401`: Unauthorized
- `403`: Bearer token is an OAuth access token or personal access token rather than a user session, or the caller is a service account. An app the caller did not create is 404, not 403.
- `404`: OAuth app not found or not visible to this caller (each user only sees apps they created)
- `429`: Rate limit exceeded
- `500`: Internal server error. A JSON body larger than 10 MB, or a form-encoded body larger than 100 KB or with more than 1000 fields, is answered `413` by the app-wide body parsers instead, also before authentication.

## Changes

- **2026-10-28** `dbb5e203b445`: 5 info
  - added the non-success response with the status `400`
  - added the non-success response with the status `500`
  - added the optional property `error/requestId` to the response with the `401` status
  - added the optional property `error/requestId` to the response with the `403` status
  - …1 more

[Operation history](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/changes/oauth-clients/:appId/regenerate-secret/post.md)

---

[API](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api.md) - [All operations](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/llms.txt) - [OpenAPI document](https://skmtc.dev/pipeshub-ai/apis/pipeshub-api/revisions/dbb5e203b445?raw)