Rotate a client secret
Mint a new secret for a confidential client.
POST /organizations/{org}/clients/{clientId}/secret
Replaces a confidential client’s secret. The old secret stops working as soon as this returns. Secrets are stored hashed, so there is no way to reveal one later: rotating is how you get a secret you can see.
Authorization
Org owner. Anyone else gets 403 forbidden.
Path parameters
| Name | Type | Description |
|---|---|---|
org | string | The organization: its id (org_…) or its slug. It has to be an org your token can manage (see Who can call it) |
clientId | string | The client, cli_… |
No body.
Response
200 OK with the client and its new client_secret.
{
"id": "cli_65f1c2a9e4b0d3f7a1c8e903",
"name": "Acme backend",
"logo": "https://…",
"redirect_uris": ["https://app.acme.com/lgw/callback"],
"confidential": true,
"ip_allowlist": [],
"client_secret": "…"
}Errors
| Status | error | When |
|---|---|---|
403 | forbidden | You are not an owner of the org |
409 | conflict | The client is public and has no secret |
404 | not_found | No such client in this org, or the id is not a cli_ id |
404 | not_found | The org does not exist, or your token cannot manage it |
Example
curl -X POST https://loginwith.loginwith.dev/organizations/acme/clients/cli_65f1c2a9e4b0d3f7a1c8e903/secret \
-H "Authorization: Bearer $TOKEN"