# pipedrive oauth invalid_client error after secret rotation

## TL;DR
invalid_client after a rotation means the code is still sending the old secret, or the rotation never saved. Open the Pipedrive OAuth app settings and confirm the current secret, then update it in your app's config and secret store, restart the services holding the old value, and test the token endpoint. Check every environment, because staging and production often hold different copies.

```text
pipedrive oauth invalid_client error after secret rotation
```

## Use this when

- Pipedrive token calls fail with invalid_client immediately after rotating the secret
- The integration worked minutes before the rotation
- Only some services fail while others still work

## Not for this skill when

- invalid_grant on code exchange (code problem, not client problem)
- The secret was never rotated (check for typos in the original setup)
- User-facing authorize errors (happens before the secret is used)

## Steps

### Step 1: Confirm the current secret

In Pipedrive open Tools and apps, your OAuth app, and verify which secret is currently active. Expected: you know the exact active secret value.

### Step 2: Update every stored copy

Replace the secret in your application config, secret manager, and any worker or background job configuration. Expected: no file or env var still holds the old secret; search the codebase to be sure.

### Step 3: Restart holders of the old secret

Restart or redeploy services that cache configuration in memory. Expected: running processes pick up the new secret.

### Step 4: Test the token endpoint

Make a token call with the new secret and confirm it succeeds. Expected: the endpoint returns tokens instead of invalid_client.

### Step 5: Cover all environments

Repeat the update for staging, production, and any regional deployments. Expected: every environment authenticates cleanly.

## Tool compatibility

Pipedrive OAuth apps (Tools and apps); OAuth 2.0 token endpoint; secret managers and app config for the integration.

## Variant phrasings

### Variant 1

pipedrive invalid_client after rotating client secret

### Variant 2

pipedrive oauth app secret rotation broke integration

### Variant 3

pipedrive token endpoint invalid_client secret mismatch

## Why it happens

invalid_client is the provider saying the client ID and secret pair does not match anything it knows. Right after a rotation, the mismatch is almost always on your side: the new secret is live at Pipedrive while your code still sends the old one, cached in an env var, a secret manager version, or a long-running worker's memory. The failure looks total and urgent, which tempts a second rotation, but rotating again just moves the target. The fix is boring and complete: find every copy of the old secret and replace it, then restart everything that might have cached it.

## Edge cases / pitfalls

- Pipedrive shows the new secret once; if you did not copy it, rotate again and this time store it in the secret manager first.
- Background workers and cron jobs are the most commonly forgotten holders of the old secret.
- Keep the old secret's last-known value out of chat logs and tickets; treat it as compromised once it has been shared around.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_XUFGxUZ5fzSpjljS1G0oEQ