I'm having a deeper look into OAuth 2.0 and especially the Client Credentials Flow that is intended to authenticate a client application or device without user interaction (the client is accessing its own resources, not acting on the behalf of a user).

The current best practices tell me to authenticate a client with an assertion token. In short: instead of a shared secret the client uses an assertion token to identify itself. This token is created by the client and signed using the private key of a certificate owned by the client. The authentication server needs to know the public key to validate this assession token.

Cyber security guidelines tell me to rotate / cycle secrets regularily. This means that I have to tell the authentication about the new public key.

What am I supposed to do when I want to rotate the secret?

The 2 obvious solutions are:

  • The client calls the Client Configuration Endpoint at the authentication server and the server adds the new public key to the list of secrets valid for this client.
  • The client publishes a jwks_endpoint and the server retrieves the new public key directly from the client when none of the registered keys are valid for the token (probably only once, the server can persist the new key in its database).

Both solutions have pros and cons. I cannot see any objectively "best" solution.

Are there any guidelines as to how secret rotation is best implemented? Have I overlooked a third solution?

My main concern is security. I cannot allow a malicious software to register its own secrets or jwks_endpoint at the authentication server or to replace a genuine client at a registered jwks_endpoint. But I cannot allow clients being locked out because their registered secrets expired and for whatever reasons they were not able to register a new secret in time, either.

If the most secure solution takes more time to implement, I'm willing to invest that time. Apart from that, I'd like to reduce network traffic and accelerate the authentication process as much as possible.

There's a related question on StackExchange from 2015 that didn't answer my question.


Using JWKS you put your public key at a known URL:


Cyber security guidelines tell me to rotate / cycle secrets regularily.

While I think it is a good idea to be able to rotate your secrets in case they get compromised, I don't think it is uniformly good advice to rotate secrets regularly. I think it is acceptable to keep the same key pair for several years.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.