An approved app authenticates to the token endpoint with its client_id and a client secret. Triple Whale does not create the secret for you and does not keep a copy you can view again. You generate it in the portal, it is shown once, and you can rotate it when you need a new one.

Generating the Secret

Open the app from Your apps.
Until a secret exists, the Settings tab starts with Generate your client secret (badge Required). The same card is under Credentials as Client secret.
Click Generate client secret.
The Your client secret dialog opens with the value and a copy control. Copy it into your secret store now.
Click I saved it. The dialog cannot be closed any other way.

❗️
Copy It Now. It Will Not Be Shown Again
The dialog title is Copy it now — it will not be shown again. Triple Whale cannot show this value a second time. Any previous client secret for this app is now invalid.

Rotating the Secret

Under Credentials, click Rotate client secret.
Read the confirmation Rotate client secret, then click Rotate secret (or Cancel).
Copy the new value from the Your client secret dialog and click I saved it.

🚧
This Breaks Every Live Connection Until You Redeploy
The current secret stops working the moment the new one is generated. There is no overlap. Merchants stay connected, but your app cannot refresh their tokens. Each merchant breaks as soon as their access token expires (within an hour) and stays broken until you deploy the new secret. Rotate only when the current secret is lost or compromised.

Who Can Do This

Generating and rotating the secret requires the Owner or Admin role. A Member sees the client_id and Ask an app admin to generate the secret. See Managing App Members.

Best Practices

Store the secret in a secrets manager. Do not put it in source control or in a client-side bundle.
Have the new secret ready to deploy before you click Rotate secret, so token refreshes fail for as short a time as possible.
If you suspect a leak, rotate immediately.