Skip to main content
Question

OAuth client secret rotation guidance

  • July 29, 2026
  • 3 replies
  • 26 views
O

We need to rotate the OAuth client secret for an existing production mobile application while older versions remain installed.

Could you clarify:

1. Can multiple client secrets remain active during migration?
2. Does generating a new secret revoke the existing secret?
3. Will existing access and refresh tokens remain valid?
4. Can existing refresh tokens be used with the new secret?
5. Will users need to authenticate again?
6. What zero-downtime migration process do you recommend?
7. Does rotation require another application review?
8. When is it safe to revoke the previous secret?

3 replies

H

The ideal approach is to keep both client secrets active during the transition so older app versions continue working while newer versions adopt the new secret. Existing access tokens should generally remain valid until they expire, and users shouldn't need to sign in again if refresh tokens continue to work. Once you're confident that nearly all active clients have migrated to the new secret, you can safely revoke the old one.

O
  • omboxsupport
  • Author
  • New Participant
  • July 30, 2026

​@harry085drop  Can you confirm whether the OAuth provider supports adding a new client secret to the same application registration while keeping the existing secret active?
If multiple concurrent secrets are supported, we can migrate to the new secret, validate traffic, and revoke the old secret after the rollout. Also, please confirm whether existing refresh tokens remain valid with the new secret.

O
  • omboxsupport
  • Author
  • New Participant
  • July 31, 2026

​@harry085drop : But we don’t allow to add multiple secret to the same app , right ?

Terms of ServiceAccessibility statement