Credentials and Rotation

Each app has a Client ID (ktc_…). A confidential app also has a client secret (kts_…). Both are on the app’s page in the portal under Credentials.

The Client Secret

The secret is shown once:

• when the app is registered;
• when it is rotated;
• when a public client becomes confidential.

Copy it then. KT Accounts keeps only a keyed hash of it and cannot show it again. The app object never contains it; hasSecret and secretRotatedAt say whether there is one and when it was made.

Send it to the token endpoint as HTTP Basic credentials (client_secret_basic) or in the form (client_secret_post). Keep it on a server. A page or a mobile app cannot keep a secret, so it is a public client and uses PKCE instead.

Rotate the Secret

Choose Rotate Secret in the portal, or:

curl -s -X POST https://accounts.aidenkt.com/api/agent/apps/$APP_ID/secret -H "Authorization: Bearer $TOKEN"

{ "clientId": "ktc_…", "clientSecret": "kts_…", "rotatedAt": 1794779798000 }

The old secret stops working at once. Access tokens already issued keep working until they expire (1 hour). A public client has no secret: 409 public_client. 10 rotations an hour per app.

Change the Client Type

Changing Client Type from public to confidential makes a secret and shows it once. Changing it from confidential to public removes the secret; every sign-in then needs PKCE.