OIDC service secrets (issue, rotate and revoke)

A «Confidential (server)» service with «Secret (Basic)» or «Secret (form)» authenticates at the token endpoint with a secret. The server keeps only a cryptographic digest of the secret.

How do I issue a secret?

1. Under «Manage» › «OIDC services», open the service.
2. Choose «Issue secret» and confirm.
3. The console shows «Copy the secret now». The secret is shown only once.
4. Give it to the service team through a secure channel (never in the same email as the identifier).

How do I rotate without interrupting the service?

The two most recent secrets stay active: «Secret issued. The two most recent secrets remain active.»

1. Issue a new secret.
2. The service team switches to it.
3. Revoke the old one (below).

How do I revoke a secret?

1. Choose «Revoke credential».
2. Enter the identifier (UUID) of the credential to revoke.
3. Confirm. «Credential revoked.» appears. The secret is refused at once.

The service gets invalid_client

• The secret is wrong, revoked or belongs to another service.
• The authentication method used differs from the registered one (for example Basic instead of form).
• With «Private key (JWT)», the client assertion was reused or the public key does not match.

Issue a new secret and update the service.

Security

• Never paste a secret into support tickets, chat or email.
• If you suspect a secret was exposed, issue a new one and revoke the old one at once.