> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Syteca secret rotation

> Rotate the shared secret that secures the connection between the Main Application and Endpoint Exposure Management to keep communication and authentication intact.

## Overview

A shared secret is used to establish and maintain a trusted connection between Syteca and the Endpoint Exposure Management module.

To maintain security and ensure uninterrupted operation, the secret should be rotated before it expires. During the rotation process, Endpoint Exposure Management supports both the old and the new secret until the previous secret reaches its expiration date, allowing administrators to update Endpoint Exposure Management without disrupting service.

<Note>
  Secret rotation requires the [Tenant Management and System Configuration administrative permission](/docs/administration/users/administrative-permissions).
</Note>

## Procedure

1. In **Syteca**, locate the Auto-generated Endpoint Exposure Management application account (syteca\_eem) and open it for editing.
2. Open the **Exposure Management Portal** in a new tab.
3. In **Syteca**, add a new secret or rotate the existing one.
4. Copy the newly generated secret.
5. Open the **Exposure Management Portal**.
6. Navigate to **Configuration**.
7. Locate the secret configuration field.
8. Paste the newly generated secret into the masked secret field.
9. Click **Save**.
10. Confirm the action when prompted.
11. Endpoint Exposure Management updates the stored secret and begins using it for communication with the Main Application.
12. The rotation event is recorded in the internal audit log.
13. Verify the **Last Updated** date displayed in the configuration page.

<Note>
  The secret must be rotated or updated before the current secret expires. Otherwise, Exposure Management Portal will become inaccessible.
</Note>

## What Happens After Rotation?

Once the new secret is saved:

* Endpoint Exposure Management begins using the new secret for authentication.
* The old secret remains valid until it expires.
* Both secrets can be used during the transition period.
* Communication between the Syteca and Endpoint Exposure Management module continues without interruption.
* The rotation event is recorded for auditing purposes.

## If the Secret Is Not Updated

If the secret expires before it is updated in Endpoint Exposure Management:

* Authentication between the Syteca and Endpoint Exposure Management module will fail.
* Users will no longer be able to access Endpoint Exposure Management through Syteca.
* Administrative intervention will be required to restore connectivity.

In this situation, follow the troubleshooting procedures to restore the trusted connection. **Troubleshooting:**

1. On the computer with the Syteca server, open a command prompt and navigate to the `<Syteca Server Installation Folder>\EEM` directory.
2. Run the following command: `eem_configtool tenant configure-parameter auth_client_secret`
3. When prompted, enter a new secret.

## Key Considerations

* Rotate secrets before their expiration date to avoid service interruptions.
* Always verify that the new secret has been successfully saved in Endpoint Exposure Management.
* The **Last Updated** field can be used to confirm when the current secret was configured.
* Secret rotation events are automatically recorded in the internal audit log for traceability and compliance purposes.
* During the grace period, both the previous and current secrets remain valid until the older secret expires.