We need roll out a new client secret for a connected app. From developer portal, it seems I can simply reset the client secret. However, I wonder what will happen if a new client secret is issued. Will exiting access tokens be revoked? We may take a few days to deploy the new client secret. Is there any way to avoid service interruption?
Thanks,
Alex
You are correct. Once you reset - the older secret becomes invalid. However, the last token retrieved will still work until it expires (the refresh token will not)...
Thank you Alex! What is the lifetime for the access token? I am glad to know resetting app secret will not revoke existing access tokens. But if a token expired, it might not be renewed if new secret is not fully deployed in prod.
https://developer.box.com/guides/authentication/tokens/
Above describes the various tokens and their time expirations.
Just to confirm my understanding from the reply above:
when I regenerate the client secret in the Developer Console, the old secret is invalidated immediately, there is no grace period and no option for two secrets (old + new) to be valid at the same time for a single client ID. Is that correct?
The reason this matters: the secret is embedded in a distributed mobile app with a huge volume of active users. Because a new app version takes several weeks to roll out, an immediate cutover would force those users to re-authenticate their Box accounts the moment the old secret is invalidated — a significant user-impact and support burden.
So two things:
1. Please confirm the immediate-invalidation / no-dual-secret behavior above.
2. Given that impact, is there any supported path an overlap window, dual (primary/secondary) secrets, or a coordinated rotation via Box support to rotate without forcing mass re-authentication?
Thanks!
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
