Create a second secret for the client, validate that it works, then delete the original secret.
If you don’t have a Konnect account, you can get started quickly with our onboarding wizard.
Set the personal access token as an environment variable:
export KONNECT_TOKEN='YOUR KONNECT TOKEN'Create an authorization server using the /v1/auth-servers endpoint, and save the AUTH_SERVER_ID and ISSUER_URL variables:
_response=$(curl -X POST "https://us.api.konghq.com/v1/auth-servers" \
--no-progress-meter --fail-with-body \
-H "Authorization: Bearer $KONNECT_TOKEN"\
-H "Content-Type: application/json" \
--json '{
"name": "Auth server example",
"description": "Auth server example",
"audience": "api://default"
}')Export the env variables:
export AUTH_SERVER_ID=$(echo "$_response" | jq -r ".id")
export ISSUER_URL=$(echo "$_response" | jq -r ".issuer")Create a client in the authorization server using the /v1/auth-servers/{authServerId}/clients endpoint, and save the CLIENT_ID and CLIENT_SECRET variables:
_response=$(curl -X POST "https://us.api.konghq.com/v1/auth-servers/$AUTH_SERVER_ID/clients" \
--no-progress-meter --fail-with-body \
-H "Authorization: Bearer $KONNECT_TOKEN"\
-H "Content-Type: application/json" \
--json '{
"name": "Client",
"grant_types": [
"client_credentials"
],
"allow_all_scopes": true,
"response_types": [
"token"
],
"token_endpoint_auth_method": "client_secret_post"
}')Export the env variables:
export CLIENT_ID=$(echo "$_response" | jq -r ".id")
export CLIENT_SECRET=$(echo "$_response" | jq -r ".client_secret")Before rotating, confirm the client can authenticate with its current secret by requesting a token from the authorization server’s token endpoint using the client credentials grant.
A successful response returns an access_token:
curl -s -X POST "$ISSUER_URL/oauth/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials" \
-d "client_id=$CLIENT_ID" \
-d "client_secret=$CLIENT_SECRET"The disable and delete operations identify a secret by its ID, not its value.
List the client’s secrets and store the current secret’s ID as $OLD_SECRET_ID.
Do this before you create the new secret, while the client still has only one secret:
OLD_SECRET_ID=$(curl -X GET "https://us.api.konghq.com/v1/auth-servers/$AUTH_SERVER_ID/clients/$CLIENT_ID/secrets" \
--no-progress-meter --fail-with-body \
-H "Authorization: Bearer $KONNECT_TOKEN" | jq -r ".data[0].id"
)Send a POST request to the /auth-servers/{authServerId}/clients/{clientId}/secrets endpoint with the secret value you want to use. In this example, you:
Create a new client secret with the value new-secret and store the value as $NEW_SECRET:
NEW_SECRET=$(curl -X POST "https://us.api.konghq.com/v1/auth-servers/$AUTH_SERVER_ID/clients/$CLIENT_ID/secrets" \
--no-progress-meter --fail-with-body \
-H "Authorization: Bearer $KONNECT_TOKEN" \
--json '{
"secret": "new-secret",
"enabled": true
}' | jq -r ".secret"
)This adds a new active secret along to the existing secret. The previous secret is still active.
Send a request with the new secret ($NEW_SECRET) to confirm the rotated secret authenticates before you disable the old one.
A successful response returns an access_token:
curl -s -X POST "$ISSUER_URL/oauth/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=client_credentials" \
-d "client_id=$CLIENT_ID" \
-d "client_secret=$NEW_SECRET"After you’ve verified the new secret works as expected, you can delete the old secret in the API by sending a DELETE request:
curl -X DELETE "https://us.api.konghq.com/v1/auth-servers/$AUTH_SERVER_ID/clients/$CLIENT_ID/secrets/$OLD_SECRET_ID" \
--no-progress-meter --fail-with-body \
-H "Authorization: Bearer $KONNECT_TOKEN"