Rotate an M2M client's secret. Runs Stytch's start + complete in one call: the old secret stops validating immediately and the new one is returned exactly once. If completing fails after start, the rotation is cancelled best-effort so the old secret keeps working and the client can retry.
POST
/account/m2m_client/{m2m_client_id}/rotate_secret
const url = 'https://api.siteqwality.com/account/m2m_client/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/rotate_secret';const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url https://api.siteqwality.com/account/m2m_client/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0/rotate_secret \ --header 'Authorization: Bearer <token>'Authorizations
Section titled “Authorizations ”Parameters
Section titled “ Parameters ”Path Parameters
Section titled “Path Parameters ” m2m_client_id
required
string format: uuid
M2M client identifier (local id, not the Stytch client_id)
Responses
Section titled “ Responses ”New secret; only returned once
Media type application/json
Response for create and rotate, the ONLY places a full secret appears. The secret is never stored and can never be retrieved again.
object
client
required
One M2M client in list responses. Never contains a secret; only the last four characters Stytch retains for display.
object
id
required
string format: uuid
client_id
required
Stytch client_id, the OAuth2 client_id used at the token endpoint.
string
name
required
string
description
string | null
scopes
required
Array<string>
created_at
required
string format: date-time
last_rotated_at
string | null format: date-time
client_secret
required
Full client secret. Shown exactly once; store it now.
string
token_endpoint
required
OAuth2 client_credentials token endpoint for this environment.
string
Example generated
{ "client": { "id": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "client_id": "example", "name": "example", "description": "example", "scopes": [ "example" ], "created_at": "2026-04-15T12:00:00Z", "last_rotated_at": "2026-04-15T12:00:00Z" }, "client_secret": "example", "token_endpoint": "example"}Missing or invalid authentication
Caller lacks the owner or admin role
Client not found or revoked
Internal server error