Certificate vs client secret
PowerToolBox accepts two credential types for the app registration: a certificate thumbprint or a client secret. Both authenticate the same way — app-only client credentials against Entra ID. Use a certificate.
The short version
| Certificate | Client secret | |
|---|---|---|
| What PowerToolBox stores | A thumbprint; the private key stays in the Windows certificate store | The secret string, read from configuration as plaintext |
| Expiry | Set on the certificate | Set on the secret; must be rotated before it lapses |
| Exposure in logs | Nothing sensitive to redact | Redacted from logs, but still present in configuration |
When a client secret is configured, PowerToolBox logs a warning at startup reminding you that certificate authentication is preferred for production.
Why certificate
With a certificate, PowerToolBox only ever holds the thumbprint. The private key stays in the CurrentUser\My certificate store, so there is no shared secret sitting in a settings file or an environment variable waiting to be copied somewhere it should not be.
The token cache is encrypted with Windows DPAPI either way, and every log line passes through a redactor that strips tokens, secrets, and authorization headers before anything hits disk. Redaction is a safety net. Not storing a secret at all is the better position.
If you use a client secret
Sometimes a secret is the pragmatic choice — a quick trial tenant, a short-lived test. If you go this way:
- Treat the secret as expired the moment it leaks. Rotate it.
- Do not paste it into shared notes or tickets.
- Prefer supplying configuration through environment variables (
PowerToolBox_*) over leaving the secret in a JSON file.
Client secrets expire. When a connection that worked starts returning 401 Unauthorized, check the secret’s expiry date in Entra ID first.
Certificate requirements
- The certificate must be installed in the
CurrentUser\Mystore for the Windows user running PowerToolBox. - The thumbprint goes in the Authentication field exactly as issued — hexadecimal, no spaces.
- Use an RSA key. MSAL does not support CNG keys for this scenario.
- The certificate must be currently valid; expired certificates are rejected.
Switching an existing connection
Edit the Authentication section of appsettings.json and change the CertificateThumbprint to a ClientSecret (or the reverse), then restart the app. The configuration reference has the full key list.
Next steps
- Entra app registration — create the app and upload the certificate.
- API permissions — the permissions to grant either way.
Last updated: July 27, 2026