How do I reset the "client secret" on the credentials of a production web app?

I am getting unexpected subscriptions created daily at 3AM (probably the result of a cron job) from an unknown source (but probably a previous developer). So I want to reset the client secret, without disruption the production app. How can I do this? Alternatively, is it possible to identify the origin of where the subscriptions are being created?