Objective
This article helps you replace an OAuth application's client secret, for example after a suspected exposure or as part of routine credential hygiene, while giving your application a grace period to switch over.
Product
Twilio Console
Environment
Twilio Console
User Account Permission/Role(s) Required
An account role that allows you to rotate an OAuth application's secret. Without it, the Rotate secret action is not shown.
Procedure
- In the Twilio Console, select Settings in the left sidebar.
- Under Account settings, select OAuth applications.
- Select the application whose secret you want to replace.
- Select the Credentials tab. It shows the application's SID and, under Secret rotation, the Rotate secret action.
- Select Rotate secret.
- In the Rotate Secret dialog, set the Grace period in days. The default is 1 day, and setting it to 0 invalidates the old secret immediately.
- Select Yes, rotate secret.
- The You have rotated your secret! step shows the new secret. Copy it and store it safely.
- Select the checkbox confirming you have saved your Client ID and Client secret in a safe place, then select Done.
Additional Information
- The grace period must be between 0 and 30 days. Other values are rejected with "Grace period must be between 0 and 30 days".
- During the grace period both the old and new secrets work, which lets you deploy the new value without downtime.
- Applications registered as a public client have no secret, so the Secret rotation section is not shown for them.
- Select No, cancel to close the dialog without rotating.
This content was generated by AI and reviewed, edited, and verified by a human.