How to access my API OAuth2 Client credentials and rotate them

Use this article when you need to copy the public client id and mint a fresh OAuth client secret on the credentials screen.

Words used in this article

• OAuth2 client credentials means the machine-to-machine flow where your server trades a client id + secret for a short-lived bearer token.

Before you start

• Open Event registration sharing while signed in to your Climb account.
• Have vault space ready (1Password, Azure Key Vault, etc.) for the one-time secret display.
• Coordinate a maintenance window if production traffic cannot tolerate a momentary credential swap.

Who can do this

Steps

1. Open Event registration sharing and press Credentials on the configuration row you integrate against.
2. Copy the OAuth2 client id value from the first card (OAuth2 client id (public identifier)).
3. If a yellow flash box shows New OAuth client secret, copy it immediately—this value is shown only once per rotation.
4. When you need a brand-new secret, submit the Generate / rotate OAuth client secret form (read the warning: old secrets stop working instantly).
5. Update your integration, then run a smoke test call against <code>/api/event/detail-sharing/v1/registrations</code> before deleting the previous secret from your secret manager.

Check the result

• You can fetch a token from /api/event/detail-sharing/v1/oauth2/token using the new secret.
• No secret is left in chat, email, or ticket comments.

If something does not work

• If you rotated accidentally, immediately generate another secret and redeploy—there is no “undo” for invalidated hashes.
• If POST returns 401, double-check JSON bodies include both client_id and client_secret keys exactly as documented in API documentation.