Feature: Support multiple client secret for better client secret rotation and usage Description: We would like to request for a new feature to allow multiple client secrets to be active at the same time for each client. Preferably, each client secret should have a name / description and set expir…

Hey there! So that’s the update from our product team on that front. This feature request makes full sense and it is in our radar of roadmap candidates. The good news is that we already offer an alternative for app credentials rotation with zero downtime. Enterprise customers can use Private Key …

This would be really useful for the use case here, and also to support using “off the shelf” libraries for authentication (use case brought up in another post Is it possible to have multiple app secrets? - #3 by dan.woda )

Hey there everyone! We’re reviewing those feedback cards on a monthly basis and I’m gonna advocate for it in the next month’s round. Will let you know once I have any updates on that front.

This seems really useful from a security standpoint and also useful for maintaining zero-downtime. I was surprised something like this wasn’t available already.

Hello, @konrad.sopala same feature request here Support multiple client secret for better client secret rotation and usage Can they be merged for gain places in the feature request rank? :wink: Regards, Jérôme

@Jerome.Piquet.AD Thanks for pointing it out. I merged them!

Hey @dan.woda , @konrad.sopala , any update if this can get promoted to the roadmap?

Hey there! We should have some kind of update on that front next week. Thank you!

Any news on this? The private key JWT solution suggested in this thread cannot be used in most third party libraries as far as I know for using OpenId Connect (M2M clients you roll yourself can of course do it easily). I’d be happy when Auth0 can provide a way to implement secret rotation without …

Hi Auth0, this topic remain open on our radar - is this topic still in roadmap consideration and what is your feedback?

Support multiple client secret for better client secret rotation and usage

Product Feedback

jessh January 11, 2023, 6:19pm 10

The worst thing is that Okta provides this feature – and auth0 and Okta are from the same company. This can’t be rocket science to add and is a really important and compelling feature!

Topic		Replies	Views
API Services - machine-to-machine authentication - multiple client secrets needed Get Help management-api , users	1	1036	November 14, 2023
How to handle Enterprise connection client secret expiration? Get Help connections , saml-enterprise-connection	1	854	May 7, 2024
Client Secret Rotation for M2M Applications in Auth0 Get Help extensions , delegated-administration-dashboard	1	263	December 17, 2024
Provisioning credentials per-client Get Help auth0 , api	3	66	September 4, 2026
Retrieve non rotating refresh token using SPA sdk Get Help auth0 , api	4	1950	August 26, 2022

Support multiple client secret for better client secret rotation and usage

Related topics