Toku Help Center

Rotate your Okta client secret for Toku

InfoLibraryclock icon3 MIN READ·calendar iconUPDATED OCT 30, 2026

Learn how to rotate your Okta client secret for Toku while maintaining continuous authentication. Follow step-by-step instructions to generate a new secret in Okta, save it in Toku, test the connection, and safely deactivate the old secret.

Use this guide to replace the client secret for your existing Toku OIDC application. You need an Okta administrator and an administrator who can update your organization settings in Toku.

Keep your current Toku admin session open. Do not deactivate the old secret until its replacement is saved in Toku and a fresh Okta sign-in succeeds.

1. Open the existing Toku app in Okta

In the Okta Admin Console, go to Applications → Applications, open your Toku application, and select General → Client Credentials. Confirm Client authentication is set to Client secret.

Open your existing Toku app, then select General at the left of the tab row. This reference screenshot from the original setup guide shows Assignments selected.

2. Generate the replacement secret

Under Client Secrets, select Generate new secret. Use the clipboard icon to copy the new secret. Both secrets remain active during the change; use the creation date to identify the new entry.

In Client Secrets, select Generate new secret. Leave the existing secret active while you update Toku. The screenshot shows the existing secret concealed.

If two secrets already exist, establish which one Toku uses before retiring either. Keep the current authentication method.

3. Save the replacement in Toku

In your existing Toku admin session, open Organization Settings and find the Okta authentication settings. Keep Okta enabled.

Paste the replacement into Okta Client Secret Key and select Save. Keep Okta Client Id and Okta Issuer Url unchanged. Enter the secret directly in Toku; do not paste it into this guide, email, or chat.

Toku’s Okta credential fields in Organization Settings: replace only Okta Client Secret Key, keep Okta enabled, and leave your existing Client Id and Issuer Url unchanged. All displayed values are fictional examples—do not copy them. Scroll down to select Save.

4. Test a fresh sign-in

Open your usual Toku sign-in page in a private or incognito window. Sign in as an assigned user through Login with Okta and confirm you reach the correct organization. Keep your original admin session open.

5. Deactivate the old secret

Return to General → Client Secrets in the same Okta application. Set the old secret’s Status to Inactive. Leave the replacement active. Test a fresh Toku sign-in again.

After saving the new secret in Toku and testing a fresh sign-in, open the older secret’s Active menu and select Inactive. Use the creation date to distinguish the old and new entries; keep the newer secret active. Both secret values are concealed.

After a successful test, you may delete the inactive secret according to your organization’s retention policy.

If sign-in fails

Before deactivation, keep the old secret active and confirm the new value was saved to the correct Toku organization. Check that Client ID and Issuer URL did not change. After deactivation, reactivate the old secret only if your security policy permits while your administrators investigate. Contact your Toku account manager if needed.

Where to find the settings in Toku

Open the profile menu at the bottom left and select Organization Settings. The Enable Okta Authentication control is on the Organization Preferences tab. For rotation, leave Okta enabled and replace only the Client Secret Key.

Organization Settings, opened from the profile menu at the bottom left, with Enable Okta Authentication on the Organization Preferences tab.

Was this article helpful?

Can't find what you're looking for?

The Toku AI assistant has read every article. A human specialist reviews every submission.