Log inTalk to us
Developer tools

Rotate an app's client secret

post/v1/teams/{team_id}/apps/{app_id}/secret
Requires an API key

The old secret stops working at once; for a first_party app only Ivora administrators rotate it (403 app_first_party_staff_only); the new one is returned once. Refused (403) to a project-limited developer while any project outside their limit has the app installed.

Path parameters

  • team_idstringRequired
    Pattern ^team_[0-9a-f]{32}$
  • app_idstringRequired
    Pattern ^app_[0-9a-f]{32}$

Returns · 200

  • idstringRequired
  • team_idstringRequired
  • namestringRequired
  • descriptionstring | nullRequired
  • icon_urlstring | nullRequired
  • ui_originsarray of stringRequired
  • extensionsarray of objectRequired
  • scopesarray of stringRequired
    The scopes the app requests; an install holds the part its installer consented to.
  • webhook_urlstring | nullRequired
    Null for a first_party app read from another team's project.
  • revisionintegerRequired
    Counts the changes to the app's scopes, origins and extensions. A consent is valid only for the revision it was given on.
  • visibilityenumRequired
    private: only the owning team's projects can install it. first_party: Ivora's own app, installable by every project and shown as made by Ivora; only Ivora administrators set it (403 otherwise).
    One of private, first_party
  • publisherstring | null
    Ivora for a first_party app, which the dashboard shows as made by Ivora; null: the team that registered it.
  • statusenumRequired
    One of active, archived
  • checkout_servicebooleanRequired
    Whether Ivora trusts the app's backend to name the driver's IP address (X-Ivora-Driver-Address) on payment creation, so the 30-a-minute per-address limit counts per driver: honoured only on a client_credentials token of an install holding billing:write, never on a session or exchanged token. Only Ivora administrators set it (403 otherwise), on an app that requests billing:write.
  • secret_prefixstring | nullRequired
    The client secret's first characters, to recognise it; the secret is shown only when it is created or rotated. Null for a first_party app read from another team's project.
  • secret_rotated_atstring | nullRequired
  • created_bystring | nullRequired
    Null for a first_party app read from another team's project.
  • created_atstringRequired
  • updated_atstringRequired
  • installsinteger | null
    Active installs, in the team's projects.
  • client_secretstringRequired
    Shown once. Keep it on the app's backend; Ivora stores only its hash.
  • webhook_secretstring | null
    Shown once, when the app is registered: the key that signs the app's lifecycle events (Ivora-Signature). Null when the client secret is rotated.
POST /v1/teams/{team_id}/apps/{app_id}/secret
curl --fail-with-body -X POST "https://api.ivoracharge.com/v1/teams/team_0123456789abcdef0123456789abcdef/apps/app_0123456789abcdef0123456789abcdef/secret" \
  -H "Authorization: Bearer $IVORA_API_KEY"
Response · 200JSON
{
  "id": "id_0123456789abcdef",
  "team_id": "team_0123456789abcdef",
  "name": "bay-01",
  "description": "string",
  "icon_url": "https://app.example.com/return",
  "ui_origins": [
    "string"
  ],
  "extensions": [
    {}
  ],
  "scopes": [
    "string"
  ],
  "webhook_url": "https://app.example.com/return",
  "revision": 1,
  "visibility": "private",
  "publisher": "Ivora",
  "status": "active",
  "checkout_service": false,
  "secret_prefix": "string",
  "secret_rotated_at": "2026-09-30T17:00:00Z",
  "created_by": "string",
  "created_at": "2026-09-30T17:00:00Z",
  "updated_at": "2026-09-30T17:00:00Z",
  "installs": 1,
  "client_secret": "string",
  "webhook_secret": "string"
}
Requires an approved production API keyProduction access starts with a request, a short meeting with Ivora and a card on file, after which Ivora staff grant your account access. How to request access
Try itproduction · api.ivoracharge.com

Paste a production api key (iv_live_…). Create keys in Developer tools. The key stays in this page's memory, is sent only to https://api.ivoracharge.com and clears when you reload. Test keys are refused.

POST is a write: you confirm the method, path and project before it is sent, with a generated Idempotency-Key.