Client Secret

Overview

Client Secret is a confidential credential used by an OAuth client to authenticate itself to an authorization server when the client can securely store secrets. It is not appropriate as a secret in public clients such as browser or mobile applications where users can inspect or extract application data.

Key risks include source-code leakage, secret reuse, insecure mobile storage, logging, excessive lifetime, weak rotation, and use by an attacker to impersonate a confidential client. Changes to Client Secret should preserve overlap or recovery where required while preventing old credentials from remaining active indefinitely.

A production implementation should store it in a managed secret system, restrict access, rotate it, separate environments, avoid logs and source control, and prefer stronger sender-constrained methods where required. Evidence for Client Secret should record the credential or certificate identifier and decision result without retaining the secret itself.

Useful measures include secret age, rotation completion, access events, failed client authentication, secrets found in repositories, and active credentials without owners. Client Secret is closely connected to Client ID, Integration Credential, and Mutual TLS Client Authentication (mTLS).

Least-privilege configuration for Client Secret should be verified against the operations used by each environment and consuming service. A compromise response for Client Secret should support rapid revocation, replacement, affected-client identification, and review of prior use.

The Client Secret boundary should identify the principal, credential or key, permitted audience, scope, lifetime, and revocation path. For Client Secret, secrets and tokens should remain outside browser bundles, URLs, ordinary logs, and unprotected configuration. Monitoring for Client Secret should track failed use, unusual scope or audience, expiry, rotation status, and attempts involving revoked credentials.