What is a client secret, and what do I do if one is compromised?
A client secret is a private key that proves an application is who it says it is. Bread & Butter uses two kinds: the Client Secret each social login provider gives you when you set up your own app with them, and the App Secret that a custom integration uses to connect to Bread & Butter. Keep both private. If one is ever exposed, you can replace it in a few minutes.
In short: A client secret works like a password between two systems. If another application tries to pretend to be yours, it's turned away because it doesn't have the secret. Provider Client Secrets, from Google, Facebook, Slack and others, are pasted into Settings, then Global Conversion Methods, and stored securely by Bread & Butter. App Secrets are created in Settings, then App & Domains, under Advanced: App Secrets, and are only needed for a manual WordPress installation or a custom integration. If a secret is compromised, create a new one, put it where the old one was used, then delete the old one.
Social login provider secrets
When you set up your own app with a social login provider, such as Google, Facebook or Slack, the provider gives you a Client ID and a Client Secret. You paste both into Bread & Butter under Settings, then Global Conversion Methods, as each provider's setup article explains.
The secret lets Bread & Butter connect your website to that provider when a visitor clicks "Continue with". Bread & Butter stores it securely, and only your account can use it.
Replacing a provider secret
Providers let you create a new Client Secret from their developer portal. If you do, update your Bread & Butter connection straight away:
- Create the new secret in the provider's developer portal and copy it.
- In Bread & Butter, go to Settings, then Global Conversion Methods, and edit that provider's connection.
- Paste in the new Client Secret and click Save.
- Once it's saved, delete or disable the old secret in the provider's portal, if the provider offers that.
Some providers stop accepting the old secret as soon as you create a new one. If yours does, visitors can't sign in with that provider until the new secret is in Bread & Butter, so make the change straight away.
Bread & Butter App Secrets
Your App Secret is what a custom integration uses, together with your App ID, to connect to Bread & Butter. You'll find it in Settings, then App & Domains, in the Advanced: App Secrets section, below your App ID.
Most customers never need one. If you installed the WordPress plugin the standard way, the connection is handled for you. You only need an App Secret for a manual installation of the WordPress plugin, or if you're building your own integration.
- It's shown only once. An App Secret is displayed only when you create it, so copy it straight away and store it somewhere secure.
- You can have more than one. Every App Secret you create stays valid until you delete it, so you can switch to a new one without any downtime.
Replacing an App Secret
If an App Secret has been exposed, or you just want to rotate it:
- In Settings, then App & Domains, create a new App Secret and copy it.
- Update your application or plugin to use the new secret.
- Once it's working, delete the old secret.
Keep your secrets safe
- Never share a secret by email or chat, or put it anywhere public, such as your website's code, a public code repository or a support ticket.
- Only give secrets to the people who need them to set up an integration.
- If you think a secret has been seen by someone who shouldn't have it, replace it. It only takes a few minutes.