Skip to content

Add OAuth client secret rotation docs #63

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mintlify wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add OAuth client secret rotation docs #63

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions apps-and-integrations/oauth.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,26 @@ Only the cal.com team can create new OAuth clients. Please fill out [this form](

The Cal.com team will register the app and provide you with the Client ID and Client Secret. Keep these credentials confidential and secure.

### Rotating client secrets

You can rotate your OAuth client secret without downtime. Cal.com supports up to two active secrets per client at the same time, so you can transition gracefully.

<Steps>
<Step title="Generate a new secret">
In your Cal.com dashboard, go to your OAuth client settings and create a new secret. Both your old and new secrets are now valid.
</Step>
<Step title="Update your application">
Replace the old `client_secret` value in your application with the new one. Verify that token exchanges and refreshes work with the new secret.
</Step>
<Step title="Delete the old secret">
Once your application is using the new secret, delete the old one from your OAuth client settings.
</Step>
</Steps>

<Warning>
You cannot delete your last remaining secret. Confidential OAuth clients must always have at least one active secret.
</Warning>

### Authorization URL

To initiate the OAuth flow, direct users to the following authorization URL:
Expand Down