How do I rotate the secret for an OAuth application? – Twilio Support

Objective

This article explains how to generate a new client secret for one of your organization's OAuth applications, either on a regular schedule to reduce the risk of credential exposure, or immediately if you believe the current secret has leaked.

Product

Twilio Organizations

Environment

Twilio Console

Procedure

In the Twilio Console, select Settings in the left sidebar.
Select Organization settings, then Organization API access.
On the OAuth applications tab, select the application whose secret you want to replace.
Open the Credentials tab. It shows the application's client ID, and for an Authorization code application its authorization URL.
In the Secret rotation section, select Rotate secret.
The Rotate Secret dialog explains that rotating generates a new secret and the previous secret becomes invalid after some time, so you should update it wherever the credentials are used as soon as possible. Select Yes, rotate secret.
The You have rotated your secret! panel shows the client ID and the new client secret. Copy the new secret and update it immediately in any application using these credentials.
Tick the acknowledgement that you have saved the client ID and client secret in a safe place, then select Done.

Additional Information

The new secret is shown only once. If you lose it before saving it, you must rotate again.
The previous secret keeps working for a short time after rotation, so you have a window to update your applications, but plan the change rather than relying on it.
Twilio suggests rotating secrets every 30 to 90 days.
The acknowledgement is required before you can close the panel. Submitting without it shows "Acknowledgement is required to continue."
Select No, cancel in the confirmation dialog to leave the current secret in place.
If the rotation fails, "Failed to rotate secret. Please try again." appears and the current secret keeps working.
If the page cannot be loaded, it shows "Unable to load Credentials".

This content was generated by AI and reviewed, edited, and verified by a human.