---
title: "Regenerate the app's secret"
method: POST
path: "/clients/{id_client}/apps/{id_app}/secret"
tags: ["apps"]
---

# Regenerate the app's secret

`POST /clients/{id_client}/apps/{id_app}/secret`

## Request

- Base URL: `https://api.planvortex.com/v1.0.0`
- URL: `https://api.planvortex.com/v1.0.0/clients/{id_client}/apps/{id_app}/secret`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (client credentials, token URL `https://api.planvortex.com/v1.0.0/oauth/token`)

Rotates the `client_secret` and returns the new one.

**The previous secret stops working the moment this answers** — there is no grace period and no overlap. Anything still holding it gets `invalid_client` from `POST /oauth/token` on its very next call, so roll it out before you rotate, not after.

**It also changes how your webhooks are signed.** `x-hub-signature` and `x-hub-signature-256` are HMACs of the body computed with this same secret, so a receiver that verifies the signature will start rejecting legitimate deliveries until it is updated too.

The new value comes back only here. If you lose it, read it again with `GET /clients/{id_client}/apps/{id_app}/secret` — it is not stored anywhere on our side except Keycloak.

**Needs a USER token, not an app token** (`ERROR_CODE_512`), and the `client_app:update` permission — reading the secret changes nothing, this invalidates what was there.

## Path parameters

- `id_client` string, required
- `id_app` string, required

## Response `200`

The new secret

- object
  - `secret` string, required

## Other responses

- `400`: Error. Classify by `code` in the body, never by the HTTP status.

---

[API](https://skmtc.dev/planvortex/apis/planvortex-api.md) · [All operations](https://skmtc.dev/planvortex/apis/planvortex-api/llms.txt) · [OpenAPI document](https://skmtc.dev/planvortex/apis/planvortex-api/revisions/abedbbc1cd52?raw)