Skip to main content
POST
Mint a client secret (the first, or a rotation)

Authorizations

Authorization
string
header
required

The dashboard's session token (Authorization: Bearer <JWT>), as the console sends it. Never paste it into a terminal: it opens every business the user belongs to.

Path Parameters

appId
string
required

One of your apps' ids. Another developer's app, or a malformed id, is 404 APP_NOT_FOUND.

Pattern: ^\d{1,20}$

Response

The new secret, and the ones it rotated out.

A minted client secret (served with Cache-Control: no-store).

data
object
required

The new secret.

rotated
object[]
required

The secrets this one rotated out: still live until their expiresAt (24 hours). Empty for the first secret.