diff --git a/app/serializers/rest/credential_application_serializer.rb b/app/serializers/rest/credential_application_serializer.rb
index bfec7d03e8..0532390c9a 100644
--- a/app/serializers/rest/credential_application_serializer.rb
+++ b/app/serializers/rest/credential_application_serializer.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class REST::CredentialApplicationSerializer < REST::ApplicationSerializer
-  attributes :client_id, :client_secret
+  attributes :client_id, :client_secret, :client_secret_expires_at
 
   def client_id
     object.uid
@@ -10,4 +10,10 @@ class REST::CredentialApplicationSerializer < REST::ApplicationSerializer
   def client_secret
     object.secret
   end
+
+  # Added for future forwards compatibility when we may decide to expire OAuth
+  # Applications. Set to zero means that the client_secret never expires.
+  def client_secret_expires_at
+    0
+  end
 end
diff --git a/spec/requests/api/v1/apps/credentials_spec.rb b/spec/requests/api/v1/apps/credentials_spec.rb
index 6e6970ce53..3c269d218e 100644
--- a/spec/requests/api/v1/apps/credentials_spec.rb
+++ b/spec/requests/api/v1/apps/credentials_spec.rb
@@ -39,6 +39,7 @@ describe 'Credentials' do
 
         expect(body_as_json[:client_id]).to_not be_present
         expect(body_as_json[:client_secret]).to_not be_present
+        expect(body_as_json[:client_secret_expires_at]).to_not be_present
       end
     end
 
diff --git a/spec/requests/api/v1/apps_spec.rb b/spec/requests/api/v1/apps_spec.rb
index 1f01bddf3c..127cab7f79 100644
--- a/spec/requests/api/v1/apps_spec.rb
+++ b/spec/requests/api/v1/apps_spec.rb
@@ -40,6 +40,7 @@ RSpec.describe 'Apps' do
             id: app.id.to_s,
             client_id: app.uid,
             client_secret: app.secret,
+            client_secret_expires_at: 0,
             name: client_name,
             website: website,
             scopes: ['read', 'write'],