<!-- llms.txt: https://workos.com/llms.txt -->

# Client secrets

Client secrets are used to authenticate Connect Applications when making requests to WorkOS APIs.

When a client secret is first created, the response includes an additional `secret` field containing the plaintext secret. This is the only time the plaintext secret will be returned.

## Create a Client Secret

Create a new client secret for a Connect Application.

This is the only time the plaintext secret will be returned and must be stored securely.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request POST \
  --url "https://api.workos.com/connect/applications/conn_app_01HXYZ123456789ABCDEFGHIJ/client_secrets" \
  --header "Authorization: Bearer sk_example_123456789"
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.connect.create_application_client_secret(id: "conn_app_01HXYZ123456789ABCDEFGHIJ")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.connect.create_application_client_secret(
    id_="conn_app_01HXYZ123456789ABCDEFGHIJ"
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Connect().CreateApplicationClientSecret(context.Background(), "conn_app_01HXYZ123456789ABCDEFGHIJ")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->connect()
    ->createApplicationClientSecret(id: "conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.connect.createApplicationClientSecret("conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Connect.CreateApplicationClientSecretAsync("conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .connect()
        .create_application_client_secret("conn_app_01HXYZ123456789ABCDEFGHIJ")
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "connect_application_secret",
  "id": "secret_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
  "secret_hint": "abc123",
  "last_used_at": null,
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z",
  "secret": "abc123def456ghi789jkl012mno345pqr678stu901vwx234yz"
}
```

:::

## Delete a Client Secret

Delete (revoke) an existing client secret.

:::code-group{title="Request"}

```bash language="curl"
curl -X DELETE https://api.workos.com/connect/client_secrets/secret_01J9Q2Z3X4Y5W6V7U8T9S0R1Q \
  --header "Authorization: Bearer sk_example_123456789"
```

```rb language="ruby"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.connect.delete_client_secret(id: "secret_01J9Q2Z3X4Y5W6V7U8T9S0R1Q")
```

```py language="python"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.connect.delete_client_secret(id_="secret_01J9Q2Z3X4Y5W6V7U8T9S0R1Q")
```

```go language="go"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Connect().DeleteClientSecret(context.Background(), "secret_01J9Q2Z3X4Y5W6V7U8T9S0R1Q")
	if err != nil {
		panic(err)
	}
}
```

```php language="php"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos->connect()->deleteClientSecret(id: "secret_01J9Q2Z3X4Y5W6V7U8T9S0R1Q");
```

```java language="java"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.connect.deleteClientSecret("secret_01J9Q2Z3X4Y5W6V7U8T9S0R1Q");
```

```cs language="dotnet"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Connect.DeleteClientSecretAsync("secret_01J9Q2Z3X4Y5W6V7U8T9S0R1Q");
```

```rust language="rust"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .connect()
        .delete_client_secret("secret_01J9Q2Z3X4Y5W6V7U8T9S0R1Q")
        .await?;

    Ok(())
}
```

:::

## List Client Secrets

List all client secrets associated with a Connect Application.

The plaintext secret is never returned after creation. Only the secret hint is included.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/connect/applications/conn_app_01HXYZ123456789ABCDEFGHIJ/client_secrets" \
  --header "Authorization: Bearer sk_example_123456789"
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.connect.list_application_client_secrets(id: "conn_app_01HXYZ123456789ABCDEFGHIJ")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.connect.list_application_client_secrets(id_="conn_app_01HXYZ123456789ABCDEFGHIJ")
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Connect().ListApplicationClientSecrets(context.Background(), "conn_app_01HXYZ123456789ABCDEFGHIJ")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->connect()
    ->listApplicationClientSecrets(id: "conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.connect.listApplicationClientSecrets("conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Connect.ListApplicationClientSecretsAsync("conn_app_01HXYZ123456789ABCDEFGHIJ");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .connect()
        .list_application_client_secrets("conn_app_01HXYZ123456789ABCDEFGHIJ")
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
[
  {
    "object": "connect_application_secret",
    "id": "secret_01J9Q2Z3X4Y5W6V7U8T9S0R1Q",
    "secret_hint": "abc123",
    "last_used_at": null,
    "created_at": "2026-01-15T12:00:00.000Z",
    "updated_at": "2026-01-15T12:00:00.000Z"
  }
]
```

:::

### connect_application_secret

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `object` | "connect_application_secret" | Yes | Always "connect_application_secret". |
| `id` | string | Yes | Unique identifier for the client secret. |
| `secret_hint` | string | Yes | A hint showing the last few characters of the secret. |
| `last_used_at` | string | No | ISO 8601 timestamp of when the secret was last used, or null if never used. |
| `created_at` | string | Yes | ISO 8601 timestamp of creation. |
| `updated_at` | string | Yes | ISO 8601 timestamp of last update. |
| `secret` | string | No | The plaintext client secret. This is only returned at creation time and cannot be retrieved later. |

### POST /connect/applications/{id}/client_secrets

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The application ID or client ID of the Connect Application. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `connect_application_secret` | object | Distinguishes the connect application secret object. |

### DELETE /connect/client_secrets/{id}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The unique ID of the client secret. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `empty` | empty | Returns an empty response on success. |

### GET /connect/applications/{id}/client_secrets

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `id` | string | Yes | The application ID or client ID of the Connect Application. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `connect_application_secret` | object[] | Distinguishes the connect application secret object. |