---
title: "Rotating API client secrets"
slug: "rotating-api-client-secrets"
updated: 2025-07-22T10:52:18Z
published: 2025-07-22T11:18:07Z
canonical: "totara.help/rotating-api-client-secrets"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://totara.help/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotating API client secrets

> [!NOTE]
> **Available f****rom Totara 19.1**

API clients for the external API automatically have a **client_id** and **client_secret** generated upon creation.

The **client_id** and **client_secret** remain the same for the life of the API client. This means that if the **client_secret** were ever publicly exposed, it required the API client to be deleted and recreated.

The **Rotate client secret** action gives the ability for the **client_secret** to be regenerated. This not only re-generates the **client_secret** but also removes any API tokens that were previously generated using it.

## How to Rotate client secret

In a Totara site with the [external API enabled](/19/docs/enable-apis), you can select Rotate client secret when viewing an [API client](/19/docs/add-an-api-client).

1. Navigate to the API client page *Quick access menu > Development > API > API* *clients.*
2. From the API clients page select the three dots ( ![](https://cdn.document360.io/a007399b-031e-436b-999a-528240e16f58/Images/Documentation/image-1742997589396.png?sv=2026-02-06&spr=https&st=2026-11-01T14%3A47%3A37Z&se=2026-11-01T15%3A47%3A37Z&sr=c&sp=r&sig=zjPXTJ3LJy7Jy7dOcuBBXoLnrbTXiRecQZLeOIuEO44%3D) ) for the API client.
3. From the menu, select **Rotate client secret**. **![](https://cdn.document360.io/a007399b-031e-436b-999a-528240e16f58/Images/Documentation/image-1742997504415.png?sv=2026-02-06&spr=https&st=2026-11-01T14%3A47%3A37Z&se=2026-11-01T15%3A47%3A37Z&sr=c&sp=r&sig=zjPXTJ3LJy7Jy7dOcuBBXoLnrbTXiRecQZLeOIuEO44%3D)**
4. A confirmation pop-up is displayed displaying the number of active API tokens currently in use. Selecting **Cancel** will close the pop-up and the **Client secret** will remain the same. When **Rotate** is selected, the **Client secret** is regenerated, and existing active tokens are removed.

![](https://cdn.document360.io/a007399b-031e-436b-999a-528240e16f58/Images/Documentation/image-1742997864112.png?sv=2026-02-06&spr=https&st=2026-11-01T14%3A47%3A37Z&se=2026-11-01T15%3A47%3A37Z&sr=c&sp=r&sig=zjPXTJ3LJy7Jy7dOcuBBXoLnrbTXiRecQZLeOIuEO44%3D)
5. The **Client secret** field will now show the new client secret value.

Note: Any external service using the specified external API client will need to be updated to use the new client secret in order to continue functioning correctly. Any services that use the previous client secret will receive an error when they attempt to make a request to the API client.

Join the [Totara Community](https://totara.community/) for more resources to help you get the most out of Totara.

© Copyright 2026 Totara Learning Solutions. All rights reserved.