General configurations cover settings that apply across application features in IDaaS. This page explains how to control API access and perform safe client secret rotation.
In the current version, administrators can enable or disable API access and perform key rotation.
To access general configurations, go to Applications, find your application, click Manage, and open the General tab.
API access
Each application can be granted access to a set of APIs. IDaaS supports three categories:
Single sign-on (SSO) via the OpenID Connect (OIDC) protocol
Account synchronization
Permission management *(coming soon)*
To call these APIs, the application authenticates using its client_id and client_secret to obtain an access_token.
By default,client_idequalsapplication_id. It starts withapp_and is approximately 26 characters long. Theclient_secretis a random string that starts withCSand is 44–46 characters long.
Key rotation
Key rotation lets you replace a client_secret without interrupting active services. IDaaS supports holding two active secrets simultaneously, so the old secret remains valid while you migrate your application to the new one.
Each application can hold at most two client_secrets at the same time, and at least one must stay enabled.
Set the validity period
On the key management page, click Set Validity Period.
In the dialog, select an expiration period:
Client secrets created through backend configurations are permanently valid by default.
Option Expiration 3 Months 3 calendar months from today. For example, if you set the key on September 18, it will expire on December 18. 6 Months 6 calendar months from today. For example, if you set the key on September 18, it will expire on March 18 of the next year. 1 Year 1 year from today. For example, if you set the key on September 18, it will expire on September 18 of the next year. Custom A date you specify; must be 1 day to 3 years from today. Permanent validity is not supported. Click OK.
Key expiration indicators
The key management page uses color indicators to flag expiring secrets:
Red — expired, or expiring within 3 days
Yellow — expiring in less than 15 days
Rotate a client secret
Rotation has two distinct phases: transitioning your application to the new secret, then removing the old one. Separating these phases lets you verify the new secret is working before you delete the old one.
Phase 1: Transition
On the key management page, create a new
client_secret. The new secret is enabled immediately.Update your application's configuration to use the new
client_secret.Click Disable on the old
client_secret. The page shows the last-use timestamp for the old secret — use this as evidence that no service is still relying on it before you continue.
Phase 2: Clean up
After disabling the old secret, monitor your application's logs and behavior for a few days to confirm everything works correctly.
Once you are confident the old secret is no longer in use, click Delete to remove it permanently.
Basic information
The General tab also displays read-only application metadata.
| Field | Description |
|---|---|
| Application ID | The resource ID of the application. Reference only; cannot be changed. |
| Source | The template used to create the application. Cannot be changed. Values: Application Template, Standard Protocol, or Custom Application. |
| Application name | The display name of the application. |
| Application icon | The display icon. Must be PNG or JPG, no larger than 1 MB. A 256 × 256 px square is recommended. |