Cowdidocs
API ReferenceOAuth clients

List the secrets of an OAuth client

GET
/v1/oauth/clients/{oauthClientId}/secrets

Lists a client's secrets, with their hints and last-used times. The plain text is not readable here; it is shown once, when the secret is minted. Requires the org:connect:read permission. Returns 404 when the caller's organization has no client with this id.

Authorization

oauth2
AuthorizationBearer <token>

Create a client with POST /v1/oauth/clients, then exchange its credentials for an access token. AUTHORIZATION_CODE clients act on behalf of a signed-in user and always use PKCE; CLIENT_CREDENTIALS clients act as themselves. A client may only be granted scopes its creator already holds — read the grantable list from GET /v1/oauth/clients/scopes.

In: header

Path Parameters

oauthClientId*string

Unique identifier of the OAuth client.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/v1/oauth/clients/app_2c9f8b3e1a7d4f56/secrets"
{  "data": [    {      "id": "sec_8f14e45fceea167a",      "secret_hint": "a1b2",      "last_used_at": "2026-03-14T09:30:00Z",      "created_at": "2026-09-01T10:15:30Z"    }  ],  "links": {    "next": "/v1/payees?after=eyJpZCI6MX0",    "prev": "/v1/payees?before=eyJpZCI6MX0"  }}
{  "code": "BAD_REQUEST",  "description": "Bad Request"}
{  "code": "UNAUTHORISED",  "description": "Unauthorised"}
{  "code": "FORBIDDEN",  "description": "Forbidden"}
{  "code": "BAD_REQUEST",  "description": "Invalid input"}
{  "code": "RATE_LIMIT_EXCEEDED",  "description": "Too Many Requests"}
{  "code": "INTERNAL_ERROR",  "description": "Internal Server Error"}

Delete an OAuth client DELETE

Deletes an OAuth client and revokes every one of its secrets. Requires the `org:connect:write` permission. Tokens already issued stay valid until they expire. Returns 404 when the caller's organization has no client with this id.

Rotate the client secret POST

Mints a second secret so the holder can roll over. Deploy it, wait for `last_used_at` on the old secret to stop moving, then revoke the old one with the revoke a client secret operation. Requires the `org:connect:write` permission. Returns 404 when the caller's organization has no client with this id, and 409 when the client already holds the maximum number of secrets.