p24-infra Docs

clickup-credential-rotation

2 min read

Playbook: ClickUp Credential Rotation

Covers: clickup_clickup_api_key

Overview

KeySOPS filePurpose
clickup_clickup_api_keyart-agencyClickUp API access for Art Agency project management automations

Tier: ❌ Tier 3 Manual — ClickUp API token management is UI-only; no rotation API exists.

When to rotate

  • On exposure: immediately
  • Scheduled: annually (ClickUp personal API tokens do not expire automatically)

Pre-rotation checklist

  • No active ClickUp API calls in flight from Art Agency automations
  • Log the current key name prefix for audit (key name only, never value)

Rotation steps

1. Regenerate API token (human required)

  1. Log in to https://app.clickup.com
  2. User Avatar (bottom-left) → Settings → Apps
  3. Under API Token → click Regenerate
  4. Confirm the regeneration dialog — the old token is immediately invalidated
  5. Copy the new token (shown once; starts with pk_)

2. Distribute (Claude handles)

Update secrets/art-agency.env.sops — key: clickup_clickup_api_key.

$env:SOPS_AGE_KEY_FILE = "C:\Users\konar\.age\p24-infra-keys.txt"
# Follow sops-edit-operations.md for the full SOPS write pattern
# Canary after write:
sops --decrypt --input-type dotenv --output-type dotenv secrets\art-agency.env.sops | Out-Null
if ($LASTEXITCODE -ne 0) { throw "SOPS corrupt — do NOT commit" }

Commit → push → secrets-sync.yml deploys the new value to Art Agency consumers.

3. Verify

# Confirm new key is accepted (exit code check only — do not print response body)
$env:K = (sops -d --input-type dotenv --output-type dotenv secrets\art-agency.env.sops |
    Select-String "^clickup_clickup_api_key=").ToString().Split("=",2)[1]
try {
    $r = Invoke-WebRequest "https://api.clickup.com/api/v2/user" -UseBasicParsing `
        -Headers @{Authorization=$env:K}
    Write-Host "Status: $($r.StatusCode)"  # Expected: 200
} catch { Write-Host "Status: $($_.Exception.Response.StatusCode.value__)" }
$env:K = ""

4. Log rotation

Append to docs/secrets-rotation-log.md:

| YYYY-MM-DD HH:MM UTC | #ISSUE | clickup_clickup_api_key | reason | radieu | art-agency.env.sops |

Recovery

If the new token doesn’t authenticate: verify it was copied completely from the ClickUp Settings page (tokens start with pk_). If the new value was lost, regenerate again — each regeneration immediately invalidates the previous token and displays a new one.

References

  • secret-rotation-access-matrix.md — Tier 3 classification
  • docs/playbooks/sops-edit-operations.md — SOPS write pattern

Graph View