...
To inform credential managers about secrets that are about to expire, email notifications are sent by WMDA. See 4. Email Notifications About Expiring Client Secrets below for more details.
Client secret that is about to expire (in less than one month) is marked with an icon next to the expiration date on the Manage API Credentials page:
1.5 Recommended Rotation Workflow
- Create new client secret.
- Update it in your system.
- Confirm connectivity.
- Delete old client secret.
...
Do not create client secrets with a short expiration date unless required for specific testing purposes. We recommend using the maximum expiration of 1 one year to minimise rotation work.
Do not share client secrets with anyone outside your organisation. Treat them as confidential credentials.
Do not use expired secrets - they will break API connections. Always create a new secret before the old one expires.
Do not delete secrets currently in use without first updating systems that rely on them. Deleting an active secret will immediately stop API access.
2. About API Credentials
| Info |
|---|
To authenticate with the WMDA APIs, a bearer token must be requested from the WMDA. For details on how the client ID and client secret are used to retrieve bearer tokens and authenticate future requests to the WMDA API, see see API authentication. |
WMDA team creates applications for members that implement WMDA APIs. To securely connect to these applications, the IT team provides API credentials, which consist of:
...
- A confidential credential linked to a specific client ID.
- Acts like a temporary password for machine-to-machine authentication.
- Required when requesting a bearer token to connect to the WMDA APIs.
- Expires after a set period. A replacement must be created and used.
- Can be managed by your organisation's credential managers on the Manage API Credentials page.
...
Each application is associated with a client ID and client secrets, which can be managed by credential managers using the portalWMDA Portal.
These applications are created and managed by the WMDA team; members cannot create or modify them.
...
4. Email Notifications About Expiring Client Secrets
The credential managers for your organisation managers will automatically receive email notifications from WMDA when a client secret is approaching expiration.
...