# Rotating client\_secret

**URL:** <https://devforum.zoom.us/t/rotating-client-secret/81072>\
**Category:** Authentication\
**Created:** [January 6, 2023, 7:01pm UTC](https://devforum.zoom.us/t/rotating-client-secret/81072 "2023-01-06T19:01:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![engineeringsupport](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@engineeringsupport](https://devforum.zoom.us/u/engineeringsupport)\
**Post date:** [January 6, 2023, 7:01pm UTC](https://devforum.zoom.us/t/rotating-client-secret/81072/1 "2023-01-06T19:01:46Z")

</div>

We have a Zoom OAuth app where we would like to regenerate the client\_secret.

I was wondering about the implications of changing the client\_secret in regards to current users of our application who have authorized our app.

Once the client\_secret is regenerated, would we need to take any additional steps like having those users reauthorize the app or would the existing access\_tokens and meetings continue to be valid since it’s the same OAuth app.

Appreciate your help!

---

<div class="post-metadata">

**Author:** ![freelancer.nak](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/freelancer.nak/32/40968_2.png) [@freelancer.nak](https://devforum.zoom.us/u/freelancer.nak)\
**Post date:** [January 7, 2023, 10:10am UTC](https://devforum.zoom.us/t/rotating-client-secret/81072/2 "2023-01-07T10:10:04Z")

</div>

@engineeringsupport Hope you will be fine.

No need to reauthorize the user’s existing user access and refresh tokens are valid. Once access\_token expired you need to refresh the access\_token using refresh\_token & regenerated client\_secret.  
👇

> [@engineeringsupport](#):
>
> Once the client\_secret is regenerated, would we need to take any additional steps like having those users reauthorize the app or would the existing access\_tokens and meetings continue to be valid since it’s the same OAuth app.

If still any thing unclear ask. Thanks

---

<div class="post-metadata">

**Author:** ![engineeringsupport](https://avatars.discourse-cdn.com/v4/letter/e/91b2a8/32.png) [@engineeringsupport](https://devforum.zoom.us/u/engineeringsupport)\
**Post date:** [January 10, 2023, 2:12pm UTC](https://devforum.zoom.us/t/rotating-client-secret/81072/3 "2023-01-10T14:12:51Z")

</div>

That’s very helpful, thank you. My last question would be if it’s possible to rotate the key without causing downtime between deployments.

My understanding is that there is a single client\_secret so when we regenerate that secret we’ll be unable to use the old one. Is it possible to have two in place for a short time?

---

<div class="post-metadata">

**Author:** ![freelancer.nak](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/freelancer.nak/32/40968_2.png) [@freelancer.nak](https://devforum.zoom.us/u/freelancer.nak)\
**Post date:** [January 10, 2023, 2:16pm UTC](https://devforum.zoom.us/t/rotating-client-secret/81072/4 "2023-01-10T14:16:48Z")

</div>

@engineeringsupport Welcome & Thanks

There is no direct way. You need to place under maintenance to your system and then update the client\_id and get back live.

---

<div class="post-metadata">

**Author:** ![anawilliam850](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/anawilliam850/32/33827_2.png) [@anawilliam850](https://devforum.zoom.us/u/anawilliam850)\
**Post date:** [January 10, 2023, 7:46pm UTC](https://devforum.zoom.us/t/rotating-client-secret/81072/5 "2023-01-10T19:46:49Z")

</div>

thanks for the explanation!