SharePoint App error AADSTS7000222: The provided client secret keys are expired

External applications can connect to SharePoint (Online and On-premise) via OAuth using a bearer token. A client ID and secret is required to establish this connection (say via a SharePoint Add-in / provider-hosted App).

Refer here for steps to generate SharePoint client id and secret.

The client secret has a default validity of one year and expires after a year. You will receive an error message like below "The provided client secret keys are expired".

The remote server returned an error: (401) Unauthorized.

{
    "error": "invalid_client",
    "error_description": "AADSTS7000222: The provided client secret keys are expired. Visit the Azure Portal to create new keys for your app, or consider using certificate credentials for added security: https://docs.microsoft.com/azure/active-directory/develop/active-directory-certificate-credentials\r\nTrace ID: [Trace ID]\r\nCorrelation ID: [Correlation ID]\r\nTimestamp: 2021-09-22 04:37:03Z",
    "error_codes": [
        7000222
    ],
    "timestamp": "2021-09-22 04:37:03Z",
    "trace_id": "[Trace ID]",
    "correlation_id": "[Correlation ID]",
    "error_uri": "https://accounts.accesscontrol.windows.net/error?code=7000222"
}

⭐ How to renew expired SharePoint client secret ?

We can either renew the existing client secret (if its not expired yet), or create a new one.
We will use SharePoint Online Management Shell (PowerShell) for this and you must be a Microsoft 365 Tenant Administrator.

Open SPO Management Shell (Run as Administrator) and run the below commands to check the the expiry date for given client ID.

Install-Module MSOnline

Import-Module MSOnline

Connect-MSOLService

(Get-MsolServicePrincipalCredential -AppPrincipalId [Enter Client ID] 
-ReturnKeyValues $true).EndDate.ToShortDateString() | select

Note the last date.

Execute the below script to create a new client secret, you can even define the new expiry date.
❗️ Important - This will work only if you are a Tenant Admin.

Connect-MSOLService

$clientId = "Enter the client ID here"

$bytes = New-Object Byte[] 32
$rand = [System.Security.Cryptography.RandomNumberGenerator]::Create()
$rand.GetBytes($bytes)
$rand.Dispose()

$newClientSecret = [System.Convert]::ToBase64String($bytes)

//Setting up the expiry date to 3 years from now
$startDate = [System.DateTime]::Now
$endDate = $startDate.AddYears(3)

New-MsolServicePrincipalCredential -AppPrincipalId $clientId -Type Symmetric -Usage Sign -Value $newClientSecret -StartDate $startDate -EndDate $endDate

New-MsolServicePrincipalCredential -AppPrincipalId $clientId -Type Symmetric -Usage Verify -Value $newClientSecret -StartDate $startDate -EndDate $endDate

New-MsolServicePrincipalCredential -AppPrincipalId $clientId -Type Password -Usage Verify -Value $newClientSecret -StartDate $startDate -EndDate $endDate
$newClientSecret

Copy the new secret value and use it for connecting now. Refer steps here to validate using Postman if the new client secret works well.