Original Message:
Sent: 01-28-2026 13:42
From: Borys Spiridonov
Subject: Cannot retrieve oauth client secret
Hi Hemanth,
I'm following up on Ihor's work and trying to put this part of our terraform code into a working state.
According to Genesys documentation
client_secret (String, Sensitive) Place holder that can be referred in integration_credential fields. Sensitive info. Only populated when expose_client_secret is true.
1. As I understand it, if we set expose_client_secret = true, we should be able to export the client_secret to another object. Is my understanding correct? (we are passing it to a custom module to save the secret in AWS Secret Manager).
resource "genesyscloud_oauth_client" "gains_service" {name = "name"access_token_validity_seconds = 86400authorized_grant_type = "CLIENT-CREDENTIALS"expose_client_secret = true}
we are properly getting
genesyscloud_oauth_client.gains_service.client_id
but the secret always appears empty.
genesyscloud_oauth_client.gains_service.client_secret
2. Can you please comment on how it is supposed to work?
------------------------------
Borys Spiridonov
.
Original Message:
Sent: 09-12-2025 09:40
From: Venkata Hemanth Dogiparthi
Subject: Cannot retrieve oauth client secret
hi @Ihor Hordiienko
We have added a new attribute to expose the secret which is configurable. Can you pull in latest terraform release and use this attribute in your resource definition to see if this works for you.
resource "genesyscloud_oauth_client" "client1" {
name = "client1"
description = "TF managed"
access_token_validity_seconds = 86400
authorized_grant_type = "CLIENT-CREDENTIALS"
directory_client_secret = "${path.module}/temp_secrets" # Local directory to save secret
expose_client_secret = true
roles {
role_id = data.genesyscloud_auth_role.admin.id
division_id = "*"
}
}
------------------------------
Hemanth Dogiparthi
Manager, Software Engineering
Original Message:
Sent: 09-03-2025 12:09
From: Venkata Hemanth Dogiparthi
Subject: Cannot retrieve oauth client secret
Hi @Ihor Hordiienko
The client_id and client_secret attributes are computed values that are only available during resource creation and client_secret are not persisted in the Terraform state to prevent sensitive data exposure
We can still internally reference them in other resources of provider (genesyscloud_integration_credential), thanks to an internal cache we are using for referring the data. These attributes are like placeholders.
To save the OAuth client credentials to a secret manager, you have a few options:- Use directory_client_secret attribute
This attribute allows you to save the secret to a local file, which you can try reading and store in your secret manager.
Example:
resource "genesyscloud_oauth_client" "client1" {
name = "client1"
description = "TF managed"
access_token_validity_seconds = 86400
authorized_grant_type = "CLIENT-CREDENTIALS"
directory_client_secret = "${path.module}/temp_secrets" # Local directory to save secret
roles {
role_id = data.genesyscloud_auth_role.admin.id
division_id = "*"
}
}
# Read the secret from the file and store in your secret manager
locals {
secret_files = fileset("${path.module}/temp_secrets", "*")
client_id = tolist(local.secret_files)[0] # The filename is the client_id
secret_data = file("${path.module}/temp_secrets/${local.client_id}")
}
module "client_oauth_creds" {
source = "xxx"
version = "~> 1.0"
name = "/secret-lair/classic/terraform-genesyscloud/production/client-dev"
content_wo = jsonencode({
"client_id" = local.client_id
"client_secret" = local.secret_data
"version" = "6"
})
content_wo_version = 6
depends_on = [
genesyscloud_oauth_client.client1
]
}
Hope this helps
Thanks
Hemanth
------------------------------
Hemanth Dogiparthi
Manager, Software Engineering
Original Message:
Sent: 09-03-2025 11:36
From: Ihor Hordiienko
Subject: Cannot retrieve oauth client secret
Hi Hemanth,
the attribute directory_client_secret just puts a secret into a file on a disk. What I am trying to do is to save it into a proper secret manager.
------------------------------
Ihor Hordiienko
Genesys Engineer
Original Message:
Sent: 09-03-2025 09:29
From: Venkata Hemanth Dogiparthi
Subject: Cannot retrieve oauth client secret
Hi @Ihor Hordiienko
You can follow the blog here https://developer.genesys.cloud/blog/oath-client-secret-CXasCode/ for accessing clientid and clientsecret via cxAsCode.
we have introduced new attribute directory_client_secret in genesyscloud_oauth_client resource which you can use to dump your client credential information. More details in the blog for reference.
Thanks
Hemanth
------------------------------
Hemanth Dogiparthi
Manager, Software Engineering
Original Message:
Sent: 09-02-2025 12:33
From: Ihor Hordiienko
Subject: Cannot retrieve oauth client secret
I am trying to save a clientId and clientsecret. Here is my tf code which seems to be set up right per Genesys' documentation but the value for the id and secret keep coming back null.
{ "client-dev": "{\"client_id\":null,\"client_secret\":null,\"version\":\"5\"}" }
resource "genesyscloud_oauth_client" "client1" {
name = "client1"
description = "TF managed"
access_token_validity_seconds = 86400
authorized_grant_type = "CLIENT-CREDENTIALS"
roles {
role_id = data.genesyscloud_auth_role.admin.id
division_id = "*"
}
}
output "client_id" {
value = genesyscloud_oauth_client.client1.client_id
description = "new client id"
}
module "client_oauth_creds" {
source = "xxx"
version = "~> 1.0"
# name of the secret in a hierarhcy path based standard format
name = "/secret-lair/classic/terraform-genesyscloud/production/client-dev"
content_wo = jsonencode({
"client_id" = genesyscloud_oauth_client.client1.client_id
"client_secret" = genesyscloud_oauth_client.client1.client_secret
"version" = "6"
})
# update this when you want to actually update content in the secret object
# so that terraform doesn't store the secret in state.
content_wo_version = 6
depends_on = [
genesyscloud_oauth_client.client1
]
}
I use 1.68.3 provider version
#CXasCode
------------------------------
Ihor Hordiienko
Genesys Engineer
------------------------------