---
title: "Generate a new client secret."
method: POST
path: "/api/v4/oauth2/client-applications/{clientId}/new-secret"
tags: ["OAuth 2.0: Client Applications"]
---

# Generate a new client secret.

`POST /api/v4/oauth2/client-applications/{clientId}/new-secret`

## Request

- Base URL: `https://na12.api.project44.com`
- URL: `https://na12.api.project44.com/api/v4/oauth2/client-applications/{clientId}/new-secret`
- Auth: HTTP basic
- TypeScript: <https://skmtc.dev/project44/apis/project44-rest-api/docs/api/v4/oauth2/client-applications/:clientId/new-secret/post.ts> (a function with typed inputs; its response is checked against the schema)

In case you have forgotten your application's client secret, or you wish to rotate it, generate a new one. Doing so invalidates the former client secret for the application, but does not invalidate any active access tokens you may have outstanding. Note you must record the client secret returned here securely as it cannot be retrieved again.
<h4><b>Required Fields</h4></b>
<ul><li> id </li></ul>

## Path parameters

- `clientId` string, required

## Response `201`

Created

- ClientApplication: Contains the attributes of an OAuth 2.0 client application.
  - `id` string: The id of the client application, generated and assigned by project44. It is an alphanumeric id. In OAuth 2.0, this is referred to as the "client_id". This id is not considered a secret, but it is generally known only to you, your application, and project44, and is part of your application's credentials, along with the client secret, which are required to authenticate your application to generate access tokens for use with project44's other APIs. If provided via HTTP Basic Authentication when generating an access token, this id is the "username" part of the base64-encoded Authorization header summary.
  - `name` string: Your name for the client application. Every application is required to have a name.
  - `secret` string: The secret part of the client application's credentials, generated and assigned by project44. In OAuth 2.0, this is referred to as the "client_secret". It cannot be retrieved again after the first time project44 returns it to you, but a new secret can be set for an application via the "new-secret" endpoint. It is confidential and should be stored encrypted at rest in a secure location for your application's use only. It is needed to authenticate your application to generate access tokens for use with project44's other APIs. If provided via HTTP Basic Authentication when generating an access token, this secret is the "password" part of the base64-encoded Authorization header summary.

## Other responses

- `400`: Invalid request
- `401`: Invalid or missing credentials
- `403`: User not authorized to perform this operation

---

[API](https://skmtc.dev/project44/apis/project44-rest-api.md) - [All operations](https://skmtc.dev/project44/apis/project44-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/project44/apis/project44-rest-api/revisions/cdf9675e2294?raw)