Changing the OAuth2 client secret

[Rob]

Hi,

Is there a way to change the OAuth2 client secret without changing the client ID?

From what I can see, the only option is to generate a new client ID and secret together, meaning any refresh tokens obtained against the old client ID are effectively useless.

If that is the case, what's the point of having a separate ID and secret? Surely they should just be a single property of the application.

This appears to be a design flaw with separating authentication from authorization. I can't periodically change the client secret as a security best practice (like changing your password on a regular basis) without having to get all my clients to re-authorize me.

[Rob]

Note that Bing Ads allow changing the client secret for a given ID in their Developer Center... it shouldn't be that difficult for Google!

[Ray Tsang (AdWords API Team)]

Rob,

I've noted this down.  However, I'm only able to help resolving AdWords API issues.  This is more related to the accounts and authentications in general.

Could I trouble you to reach out via Google Accounts API related forums?

Thanks,

Ray

[Rob]

Thanks Ray, I've posted a question there...

http://stackoverflow.com/questions/23679229/generating-a-new-client-secret

Rob.

[Ray Tsang (AdWords API Team)]

Thanks Rob.  I've also notified the relevant teams.

Cheers,

Ray

[Rob]

Hi Ray,

So far my post on that forum has gained a couple of votes and comments but nothing from the Google team.

This is a serious security request, as we cannot change what is effectively our application password. That could result in leaks or damage to your clients' data if it's not addressed. Please could you escalate this if at all possible.

[Josh Radcliff (AdWords API Team)]

Hi Rob,

Ray or I will let you know as soon as we have any updates from the relevant teams, but for the time being if you need to reset a client_secret you can do so from the prior version of developer console. To get to the prior version, click the Return to original console link at the bottom of https://console.developers.google.com/project.

Cheers,

Josh, AdWords API Team

[Rob]

Thanks Josh, I wasn't aware of the original console link. Resetting the client secret there works perfectly.

[Josh Radcliff (AdWords API Team)]

Hi Rob,

I'm happy to report that you can now reset the client secret in the new Google Developers Console as well by clicking the Reset secret button.

Cheers,

Josh, AdWords API Team

[Rob]

That's great news Josh, thanks for following up on this.

[thg...@gmail.com]

Hi Josh,

Google account client_id and client_secret leak, not app client_id, i changed the password, these are not reset. Is the change password invalid?

[Josh Radcliff (AdWords API Team)]

Hi,

Sorry, I'm not 100% clear on the issue you described in the post below. Could you provide more details?

Note that if you'd prefer, you can send the details only to me by clicking Reply privately to author on this post.

Thanks,

Josh, AdWords API Team