Rotating OAuth client secrets without downtime — step by step

NICE CXone API & Integrations
1

I’ve spent hours trying to figure out why my SvelteKit server-side route crashes when I try to rotate the OAuth client secret for my internal status widget. I am building a lightweight dashboard that polls Genesys Cloud queue stats every 15 seconds using the fetch API from a /api/v2/queues endpoint. Currently, I store the client secret in an environment variable and use the OAuth proxy pattern to get a new access token via /oauth/token when the old one expires. This works fine until I need to rotate the secret in the Genesys Cloud admin console.

The problem is that I have two clients: the old one with the expiring secret and the new one with the new secret. I want zero downtime. If I just swap the env var, the server restarts, and I lose the active polling state. If I don’t restart, the old secret fails. I tried a dual-secret approach where I check both secrets sequentially, but the HTTP 401 Unauthorized errors are flooding my logs during the switch window. Here is my current token refresh logic:

async function getAccessToken() {
 const res = await fetch('https://api.mypurecloud.com/oauth/token', {
 method: 'POST',
 headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
 body: new URLSearchParams({
 grant_type: 'client_credentials',
 client_id: PUBLIC_ID,
 client_secret: SECRET_KEY // This is the single source of truth
 })
 });
 return res.json();
}

I need a step-by-step guide or code pattern to handle this rotation. Specifically:

  1. How do I implement a fallback mechanism in the JavaScript code that tries the new secret if the old one fails, without blocking the main thread?
  2. What is the correct API endpoint to validate if a secret is still active before attempting a token request?
  3. Should I use a TTL cache for the access token to reduce the frequency of secret validation during the rotation period?

I am using Node.js in the SvelteKit +server.ts file. I need to ensure the widget stays green and connected. Any working example of a graceful secret rotation script would be appreciated. I am tired of manual restarts.