credential
Add ability to rotate app credentials.
One of our team members accidentally checked our RingCentral app credentials into our GitHub repository, necessitating a rotation of the secrets. However, THERE IS NO MECHANISM TO ROTATE SECRETS! Developer support just told me that I have to create a whole new app and then suspend the old one.
This introduces friction for doing the responsible thing. Instead of simply pressing "generate new credentials" I have to create a new app with a distinct name, go back and forth verifying that I choose all the same settings, alter my code and/or configurations to use the new app name, and then suspend the old app.
It also appears that I can't delete suspended apps, so if we want to responsibly rotate secrets from time to time then the old, suspended apps are going to accumulate endlessly. This too is a minor security risk, as an old version of the app with burned/leaked credentials could accidentally get re-enabled.
Frankly I find this rather shocking and I am going to escalate this issue however I can. It is a complete waste of my time and suggests that RingCentral is rather naive about modern security practices. Our company is on the verge of investing serious time and energy into building a RingCentral integration, but I am going to pause the work until we get a more serious answer about this.