> ## Documentation Index
> Fetch the complete documentation index at: https://docs.photon.codes/docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Use Stable documentation by default. Honor an explicit Beta request or a URL under /docs/beta/. If the requested version conflicts with the installed CLI package or API origin, clarify the target before writing integration code.
> Pages under /docs/beta/ document Beta; other product pages document Stable. Keep the CLI package, commands, API origin, and credentials within the selected version. State the documentation version in your answer.
> For MCP search, always pass version: Stable or version: Beta. Unfiltered search mixes both versions. For filesystem reads, keep Beta queries under /beta/ and exclude /beta/ from Stable queries; discover paths before reading them.
> The public docs base is https://photon.codes/docs. Convert MCP page paths to public URLs under that base, preserving /beta/ when present. Read https://photon.codes/docs/skill.md for version selection and https://photon.codes/docs/llms.txt for the version indexes.

# Rotate an organization OAuth client's secret

> Rotate an organization OAuth client's secret: rotateOrganizationOauthClientSecret in the TypeScript, Python, Rust and Go clients.

`POST /v1/organizations/{organizationId}/oauth/clients/{clientId}/secret/rotate`

Mints a new secret, then retires the one it replaces: `normal` keeps the old one working for one hour, `emergency` stops it now. A secret not created through Photon always stops now. Rotating again ends an earlier grace period. Retain the same UUID Idempotency-Key when retrying: only the delivering request returns plaintext.

**TypeScript**

```typescript TypeScript theme={null}
photon.organizations.rotateOrganizationOauthClientSecret(input: RotateOrganizationOauthClientSecretInput, options?: RequestOptions): Promise<RotateOrganizationOauthClientSecretOutput>
```

**Python**

```python Python theme={null}
photon.organizations.rotate_organization_oauth_client_secret(input: RotateOrganizationOauthClientSecretInput) -> models.RotateOrganizationOauthClientSecretResponse
```

**Rust**

```rust Rust theme={null}
client.rotate_organization_oauth_client_secret(organization_id: String, client_id: String, idempotency_key: String, body: &types::RotateOrganizationOauthClientSecretRequest).await -> Result<ResponseValue<types::RotateOrganizationOauthClientSecretResponse>, Error<RotateOrganizationOauthClientSecretError>>
```

**Go**

```go Go theme={null}
client.Organizations.RotateOrganizationOauthClientSecret(ctx context.Context, params *RotateOrganizationOauthClientSecretParams, opts ...RequestOption) (*RotateOrganizationOauthClientSecretResponse, error)
```

```typescript TypeScript theme={null}
import { Photon } from "@photon-ai/api";

const photon = new Photon({
  headers: { Authorization: `Bearer ${process.env.PHOTON_API_TOKEN}` },
});
const result = await photon.organizations.rotateOrganizationOauthClientSecret({
  path: {
    organizationId: "organizationId",
    clientId: "clientId",
  },
  headers: {
    "idempotency-key": "idempotency-key",
  },
  body: {
    mode: "normal",
  },
});
```

```python Python theme={null}
import os

from photon_api import Photon
from photon_api.rpc_generated import RotateOrganizationOauthClientSecretInput

photon = Photon(headers={"Authorization": f"Bearer {os.environ['PHOTON_API_TOKEN']}"})
result = photon.organizations.rotate_organization_oauth_client_secret(
    RotateOrganizationOauthClientSecretInput.model_validate({
        "path": {
            "organizationId": "organizationId",
            "clientId": "clientId",
        },
        "headers": {
            "idempotency-key": "idempotency-key",
        },
        "body": {
            "mode": "normal",
        },
    })
)
```

```rust Rust theme={null}
use photon_ai_api::{Credential, PhotonClientBuilder, SecretString};

let token = std::env::var("PHOTON_API_TOKEN")?;
let client = PhotonClientBuilder::new()
    .credential("accountServiceKey", Credential::Bearer(SecretString::from(token)))
    .build()?;
let result = client
    .rotate_organization_oauth_client_secret(
        "organizationId".to_owned(),
        "clientId".to_owned(),
        "idempotency-key".to_owned(),
        &serde_json::from_value(serde_json::json!({
            "mode": "normal",
        }))?,
    )
    .await
    .map_err(|error| format!("{error:?}"))?
    .into_inner();
```

```go Go theme={null}
import (
	"context"
	"encoding/json"
	"os"

	photonapi "github.com/photon-hq/api/packages/go"
)

ctx := context.Background()
client := photonapi.NewClient(photonapi.WithAPIKey(os.Getenv("PHOTON_API_TOKEN")))
var body photonapi.RotateOrganizationOauthClientSecretRequest
if err := json.Unmarshal([]byte(`{
	"mode": "normal"
}`), &body); err != nil {
	return err
}
result, err := client.Organizations.RotateOrganizationOauthClientSecret(ctx, &photonapi.RotateOrganizationOauthClientSecretParams{
	OrganizationID: "organizationId",
	ClientID: "clientId",
	IdempotencyKey: "idempotency-key",
	Body: body,
})
if err != nil {
	return err
}
_ = result
```

```json 200 theme={null}
{
  "previousSecretValidUntil": null,
  "value": null
}
```

## Parameters

**organizationId** `string` *required*

**clientId** `string` *required*

**idempotency-key** `string (uuid)` *required*

## Body

**mode** `RotateOrganizationOauthClientSecretRequestMode` *required*

## Returns

**`200`** Secret rotated. `previousSecretValidUntil` is when the old one stops working, null once it has. RotateOrganizationOauthClientSecretResponse

**previousSecretValidUntil** `string (date-time) | null` *required*

**value** `string | null` *required*


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.