Client ID and client secret
In OAuth 2.0, every registered application gets a client ID and, for confidential clients, a client secret. The ID is public: it appears in authorization URLs and logs. The secret is the application’s password and must stay on the server.
This generator makes both at once: a 24-character Base62 ID, or hex or a UUID if you prefer, and a 48-character Base62 secret with about 286 bits of entropy.
Handling client secrets
- Store a hash of the secret, as you would for an API key, and show the plain value only once.
- Never put a client secret in a mobile app or in browser code. Public clients should use the authorization code flow with PKCE instead.
- Allow several active secrets per client so you can rotate without downtime.
Frequently asked questions
Does the client ID need to be random?
It does not have to be secret, but random IDs avoid revealing how many clients you have and are easy to keep unique.
How long should a client secret be?
At least 32 random characters. The default of 48 Base62 characters is generous and safe to send in HTTP Basic authentication headers.