## TL;DR
Update the stored client secret to the new value everywhere the agent reads it. Rotation changes the secret; the agent still presents the old one.

## Error
```text
Okta authentication failed: invalid client secret (after rotation)
```

## Steps
1. Confirm the rotation: check when the OAuth app's client secret was last rotated. Expected: the rotation event found.
2. Update the secret in the agent's credential store (and in every environment the agent runs in). Expected: the new secret stored.
3. Test authentication in isolation before the next full audit run. Expected: auth succeeds.
4. Re-run the audit. Expected: the scan completes.

## When to use
- Okta auth fails immediately after a secret rotation
- The agent uses OAuth client credentials
- Multiple environments share the secret

## When not to use
- The credential is an API token (mint a new token instead)
- Auth fails with no rotation (check the app config)
- The error is a scope problem (a permissions issue)

## Tool compatibility
Okta OAuth service apps.

### Variant phrasings
### rotation in one environment, failure in another
Every environment needs the update. Audit all of them.

### want rotation without downtime
Use overlapping secrets where the platform supports it, or rotate during a maintenance window.

## Why it happens
Rotation is a coordinated change across the IdP and every consumer. The IdP side is one click; the consumer side is every place the old secret was stored, and any missed one breaks.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_bmPcM-B6Ms7rRk1u7o176w