Client ID & secret generator
OAuth-style credential pairs for APIs and integrations: a public client ID and a long random secret, ready to paste as .env or JSON. Nothing you generate here is sent anywhere.
Prefixes take letters, digits and _ . - only, so neither value ever needs quoting.
How it works
One public, one private.
The ID names, the secret proves
The client ID identifies an application and can appear in URLs and logs. The secret proves the caller is that application, and belongs only in server-side config or a secrets manager.
Long, because nobody types it
A secret is pasted, never typed, so there is no reason to keep it short. 256 random bits cannot be brute-forced, and base62 selects with a single double-click.
Prefixes catch leaks
A distinctive prefix such as acme_sk_ makes a leaked secret easy to match with a regular expression, which is how secret scanners spot them in commits and logs.
Common questions
Which client ID format should I use?
UUID v4 if your system already stores UUIDs - it is the most widely recognised. Hex and base62 are shorter on screen and carry slightly more randomness. A client ID is not secret, so any of the three is fine.
How should I store a client secret?
Show it once, when it is created, and store only a hash of it. Because the secret is long and random, a single SHA-256 is enough - unlike a password, it does not need a slow hash such as bcrypt. When a client authenticates, hash what it sends and compare the two in constant time.
Why is base62 the default encoding?
It uses only letters and digits, so the whole value selects with a double-click and never needs escaping in a URL, a header or a .env file. Base64url is just as safe, but its hyphens and underscores break double-click selection. Hex is the longest of the three for the same strength.
How do I get a client secret to the developer who needs it?
Not in the ticket, the chat thread or the email that sets up the integration, where it stays readable for as long as they exist. Share the pair as a one-time link that burns after reading, and tell the developer on another channel that it is coming.
Is anything sent to a server?
No. Both values are generated in this browser tab. If you choose to share them, they are encrypted in your browser before anything is stored.