Generate new API App Secrets

This post relates to the Legacy GoCardless API. If you're starting a new integration, you'll need to use the new GoCardless API - for help getting started, check out our guide.

If you're a developer using the GoCardless API, it's now possible for you to change the App Secret associated with your account. Simply head to the Developer section of you GoCardless account and click ‘Generate new app secret’.


This new feature also allows you have have multiple App Secrets for a single account. You'll be able to sign requests to the GoCardless API with any of your active App Secrets. When GoCardless needs to communicate with your servers (i.e., when we send you web hooks) we'll use the App Secret marked as ‘Primary’ to sign our requests.

If you ever need to delete an App Secret, simply select the ‘Revoke’ option under the relevant key - requests can’t be sent with a revoked App Secret.

Not only does this feature give you more security, it also allows you to rotate your App Secrets with the minimum amount of downtime.