Skip to content

Rotate the client secret

The client secret is shown once, at registration. TrustNet stores only a hash and cannot retrieve the original, so a lost or compromised secret must be reissued.

Reissue in the portal

  1. Open the RP in the portal (https://me.trustnet.app/rp → your RP).
  2. Use Reissue secret on the RP's detail page.
  3. Copy the new secret immediately. It is shown once, and the previous secret is invalidated at the same moment.

Reissuing changes only the client credential:

  • the client_id stays the same;
  • existing tokens and user consents are not revoked;
  • the old secret stops working immediately, so update your deployment before or atomically with the reissue.

The portal requires an AAL2 session and a fresh step-up for this action.

Automate via the management API

The portal calls:

POST /api/v1/rp/rps/{rp_id}/secret/reissue

The response contains client_id and the new client_secret, shown once. This is a first-party portal endpoint: it uses your portal session (AAL2 + step-up + CSRF header), not the RP's client secret.

Rotation strategy

  • Rotate immediately if a secret was exposed in logs, source control or a support bundle.
  • There is no automatic rotation. If you operate a scheduled rotation, expect a short overlap problem: TrustNet does not keep the previous secret valid, so plan the deployment to switch credentials at the same time.
  • Store the secret in a secret manager; never in client-side code, a public repository, or an example configuration file.