Playbook: rotate a credential
Where every secret lives until Infisical centralizes it.
Until Infisical is adopted (ADR 10), a rotation touches up to three places. Missing one causes confusing partial breakage.
| Secret | Lives in |
|---|---|
| VERCEL_TOKEN | console .env.local, console Vercel env, porter GitHub secrets |
| GITHUB_TOKEN / PORTER_GH_PAT | console .env.local + Vercel env; porter secrets |
| UMAMI_USERNAME / UMAMI_PASSWORD | console .env.local + Vercel env; porter secrets |
| EDITOR_PASSWORD | console Vercel env |
Steps: update value everywhere it lives, redeploy the console (env changes need a redeploy; an empty commit works), then verify a console API call that uses the credential. The Vercel env API supports upsert: POST /v10/projects/<id>/env?upsert=true.
Known trap: tokens taken from the Vercel CLI’s auth.json are 8-hour OAuth tokens. Use a no-expiration dashboard token for services.