shawkins · Sep 21, 2026
@@ -15,7 +15,7 @@
             "type" : "string",
             "minLength" : 6,
             "maxLength" : 255,
-            "description" : "Secret used to authenticate this client with Secret authentication. Validation: size must be between 6 and 255; on update: Client secret must not be blank"
+            "description" : "Secret used to authenticate this client with Secret authentication. Will only be populated by the server when generated, otherwise it will be omitted.. Validation: size must be between 6 and 255; on update: Client secret must not be blank"
           },
           "certificate" : {
             "type" : "string",

@@ -107,7 +107,7 @@ public static class Auth extends BaseRepresentation {
         private String method;
 
         @Size(min = 6, max = 255)
-        @JsonPropertyDescription("Secret used to authenticate this client with Secret authentication")
+        @JsonPropertyDescription("Secret used to authenticate this client with Secret authentication. Will only be populated by the server when generated, otherwise it will be omitted.")
         private String secret;
 
         @Size(max = 65536)

@@ -203,7 +203,8 @@ private BaseClientRepresentation onCreateOrUpdate(BaseClientRepresentation clien
             }
 
             // Generate random secret if applicable
-            String currentSecret = generateClientSecretIfNeeded(client, model, context == PatchClient.class);
+            String currentSecret = model.getSecret();
+            String generatedSecret = generateClientSecretIfNeeded(client, model, context == PatchClient.class);
             if (!create) {
                 session.clientPolicy().triggerOnEvent(new AdminClientUpdateContext(proposedRepresentation, model, permissions.adminAuth()));
             }
@@ -223,7 +224,7 @@ private BaseClientRepresentation onCreateOrUpdate(BaseClientRepresentation clien
             if (create) {
                 session.clientPolicy().triggerOnEvent(new AdminClientRegisteredContext(model, permissions.adminAuth()));
             } else {
-                ClientModelContext updatedContext = currentSecret != null
+                ClientModelContext updatedContext = generatedSecret != null && currentSecret != null
                         ? new ClientSecretRotationContext(proposedRepresentation, model, currentSecret, permissions.adminAuth())
                         : new AdminClientUpdatedContext(proposedRepresentation, model, permissions.adminAuth());
                 session.clientPolicy().triggerOnEvent(updatedContext);
@@ -244,7 +245,13 @@ private BaseClientRepresentation onCreateOrUpdate(BaseClientRepresentation clien
 
             EntityManagers.flush(session, false); // flush to ensure the timestamps are updated
             fireAdminEvent(create ? OperationType.CREATE : OperationType.UPDATE, schema.fromModel(model));
-            return schema.fromModel(model);
+            var result = schema.fromModel(model);
+
+            // the only time we make the secret visible is when it is generated
+            if (generatedSecret != null && result instanceof OIDCClientRepresentation oidcClient && oidcClient.getAuth() != null) {
+                oidcClient.getAuth().setSecret(generatedSecret);
+            }
+            return result;
         } catch (ClientPolicyException e) {
             throw new ServiceException(e.getErrorDetail(), Response.Status.BAD_REQUEST);
         }
@@ -463,25 +470,26 @@ private ClientRepresentation getProposedOldRepresentation(RealmModel realm, Base
     }
 
     private String generateClientSecretIfNeeded(BaseClientRepresentation client, ClientModel model, boolean rotateSecret) {
-        String currentSecret = null;
+        String generatedSecret = null;
         if (client instanceof OIDCClientRepresentation oidcClient
                 && OIDCClientRepresentation.PROTOCOL.equals(client.getProtocol())) {
             var auth = oidcClient.getAuth();
             if (auth != null && isClientSecret(auth.getMethod()) && isBlank(auth.getSecret())) {
                 if (rotateSecret) {
-                    currentSecret = model.getSecret(); // return current password for rotation
-                    auth.setSecret(KeycloakModelUtils.generateSecret(model));
+                    generatedSecret = KeycloakModelUtils.generateSecret(model);
+                    auth.setSecret(generatedSecret);
                 } else {
                     // for non-rotation, only create the secret if it doesn't already exist
                     if (!isBlank(model.getSecret())) {
                         auth.setSecret(model.getSecret());
                     } else {
-                        auth.setSecret(KeycloakModelUtils.generateSecret(model));
+                        generatedSecret = KeycloakModelUtils.generateSecret(model);
+                        auth.setSecret(generatedSecret);
                     }
                 }
             }
         }
-        return currentSecret;
+        return generatedSecret;
     }
 
     /**

@@ -97,7 +97,7 @@ private OIDCClientRepresentation.Auth getAuth(ClientModel model) {
         if (!model.isPublicClient()) {
             OIDCClientRepresentation.Auth auth = new OIDCClientRepresentation.Auth();
             auth.setMethod(model.getClientAuthenticatorType());
-            auth.setSecret(model.getSecret());
+            // the secret is not copied - it will only be present when generated
             return auth;
         }
         return null;