> ## Documentation Index
> Fetch the complete documentation index at: https://specterops-fetch-json-component.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Okta_ClientSecret

> A secret used by applications to authenticate to the Okta API

<img noZoom src="https://mintcdn.com/specterops-fetch-json-component/pkiaFEhjWYPnhxMb/assets/enterprise-AND-community-edition-pill-tag.svg?fit=max&auto=format&n=pkiaFEhjWYPnhxMb&q=85&s=c83d7e4a67c741a979c0e77bf15c1252" alt="Applies to BloodHound Enterprise and CE" width="482" height="45" data-path="assets/enterprise-AND-community-edition-pill-tag.svg" />

## Overview

Client secrets are used by API service integrations and OIDC applications to authenticate with Okta and obtain access tokens.

<img src="https://mintcdn.com/specterops-fetch-json-component/Aknesi2NwciziFMX/images/extensions/oktahound/reference/app-client-secret-creation.png?fit=max&auto=format&n=Aknesi2NwciziFMX&q=85&s=15daf9c5f9138de613d8af49d50102d3" alt="Okta client secret creation" width="1071" height="526" data-path="images/extensions/oktahound/reference/app-client-secret-creation.png" />

An application can have up to two client secrets configured, to allow for secret rotation.

<img src="https://mintcdn.com/specterops-fetch-json-component/Aknesi2NwciziFMX/images/extensions/oktahound/reference/app-client-secret-rotation.png?fit=max&auto=format&n=Aknesi2NwciziFMX&q=85&s=ba851d1760bc9db7a8ce4251e03bfa02" alt="Okta client secret rotation" width="1068" height="435" data-path="images/extensions/oktahound/reference/app-client-secret-rotation.png" />

Client secrets are represented as `Okta_ClientSecret` nodes in BloodHound.

## Edges

<Note>
  The tables below list edges defined by the OktaHound extension only. Additional edges to or from this node may be created by other extensions.
</Note>

### Inbound Edges

| Edge Type                                                                                       | Source Node Types                                                                                                                                                                                                                         | Traversable |
| ----------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------- |
| [Okta\_ReadClientSecret](/opengraph/extensions/oktahound/reference/edges/okta_readclientsecret) | [Okta\_User](/opengraph/extensions/oktahound/reference/nodes/okta_user), [Okta\_Group](/opengraph/extensions/oktahound/reference/nodes/okta_group), [Okta\_Application](/opengraph/extensions/oktahound/reference/nodes/okta_application) | ✅           |

### Outbound Edges

| Edge Type                                                                       | Destination Node Types                                                                                                                                                                           | Traversable |
| ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------- |
| [Okta\_SecretOf](/opengraph/extensions/oktahound/reference/edges/okta_secretof) | [Okta\_Application](/opengraph/extensions/oktahound/reference/nodes/okta_application), [Okta\_ApiServiceIntegration](/opengraph/extensions/oktahound/reference/nodes/okta_apiserviceintegration) | ✅           |

## Properties

| Name          | Source                      | Type       | Description                                              |
| ------------- | --------------------------- | ---------- | -------------------------------------------------------- |
| `id`          | `secret.id`                 | `string`   | Unique client secret identifier.                         |
| `name`        | `secret.secretHash`         | `string`   | Hash of the secret value used as name/display label.     |
| `displayName` | `secret.secretHash`         | `string`   | Display label used in BloodHound.                        |
| `oktaDomain`  | Collector context (non-API) | `string`   | Okta organization domain where the client secret exists. |
| `status`      | `secret.status`             | `string`   | Current lifecycle status of the secret.                  |
| `created`     | `secret.created`            | `datetime` | Secret creation timestamp.                               |
| `lastUpdated` | `secret.lastUpdated`        | `datetime` | Last update timestamp for the secret metadata.           |

## Sample Property Values

```yaml theme={null}
id: ocsxqwizfyqsf0aVG697
name: T1e6fl4jGqvPkgd94NKx5g
displayName: T1e6fl4jGqvPkgd94NKx5g
oktaDomain: contoso.okta.com
status: ACTIVE
created: 2025-11-24T12:24:08.000Z
lastUpdated: 2025-11-24T12:24:08.000Z
```

<Info>
  For security reasons, the OktaHound collector does not write cleartext client secrets
  to the OpenGraph JSON, only their hashed identifiers.
</Info>