Credential Automation Registry
Single source of truth for which services Claude can manage keys/tokens autonomously and how.
Full rotation policy (triggers, SLAs, audit trail): credential-rotation-policy.md
Fully automated — API (no browser needed)
Claude can create, rotate, and delete keys entirely via API calls.
| Service | Key(s) | Admin credential | Location | Playbook |
|---|---|---|---|---|
| OpenAI admin keys | OPENAI_ADMIN_KEY | self (POST /organization/admin_api_keys) | secrets/monitoring.env.sops | openai-key-management.md §5 |
OpenAI project keys (sk-proj-…) | WAP_OPENAI_KEY_MINI, OPENAI_API_KEY | OPENAI_ADMIN_KEY via service account (POST /organization/projects/{id}/service_accounts) | secrets/monitoring.env.sops | openai-key-management.md §4 |
| Supabase | SUPABASE_SERVICE_ROLE_KEY, SUPABASE_ANON_KEY | ROLE_SECRET_MANAGER_SUPABASE_ACCESS_TOKEN | secrets/role-secret-manager.env.sops (moved from monitoring.env.sops 2026-07-05, 2620) | supabase-service-key-rotation.md · supabase-access-token-rotation.md |
| Wasabi IAM (non-admin keys) | P24_INFRA_WASABI_ACCESS_KEY, WASABI_ACCESS_KEY | WASABI_ADMIN_ACCESS_KEY + WASABI_ADMIN_SECRET_KEY | .env.local | wasabi-key-rotation.md |
| Cloudflare zone tokens | CF_EDIT_ALL_ZONES_API_TOKEN, CLOUDFLARE_TOKEN_ZINTEGROWANA, CF_WORKERS_API_TOKEN | CF_GLOBAL_API_KEY | secrets/monitoring.env.sops | cloudflare-credential-rotation.md |
| Vercel env vars (set/delete) | any VERCEL-consumed var | VERCEL_TOKEN | secrets/monitoring.env.sops | vercel-token-rotation.md |
| GitHub Secrets | any GH_SECRET | PAT with secrets scope | secrets/n8n-bms4.env.sops | github-pat-rotation.md |
| Resend API | RADEK_BRAND_RESEND_API_KEY | Resend API key (admin) | secrets/monitoring.env.sops | resend-api-key-rotation.md |
| Traccar admin key | TRACCAR_ADMIN_KEY, TRACCAR_GW_ADMIN_KEY | Traccar REST API | secrets/monitoring.env.sops | traccar-admin-key-rotation.md |
| Mailgun | MAILGUN_API_KEY | Mailgun API | secrets/monitoring.env.sops | mailgun-api-key-rotation.md |
| Sentry | SENTRY_AUTH_TOKEN | Sentry org token | secrets/monitoring.env.sops | sentry-token-rotation.md |
Playwright-automatable — browser UI (no human present needed)
Claude drives a browser via Playwright. Requires Google session alive in the Playwright profile (radieu@gmail.com). If expired: ~2 min Google login + 2FA push first.
| Service | Key(s) | Browser entry point | Playbook |
|---|---|---|---|
| Anthropic Console | ANTHROPIC_API_KEY, WAP_ANTHROPIC_API_KEY | console.anthropic.com/account/keys | anthropic-api-key-rotation.md |
| OpenAI platform | project keys if Playwright preferred over API | platform.openai.com/api-keys | openai-key-management.md §4 |
| Discord Developer Portal | DISCORD_BOT_TOKEN (existing bot) | discord.com/developers/applications | discord-bot-token-rotation.md |
| Discord provisioning (new bots/channels) | DISCORD_<NAME>_BOT_TOKEN (new bots) | discord.com/developers/applications · discord.com/channels/<guild> | discord-provisioning.md · scripts/discord-provisioning.py |
| IONOS Developer Portal | IONOS_HOSTING_TOKEN_PREFIX + _ENCRYPTION | developer.hosting.ionos.de | ionos-api-token-rotation.md |
| Telegram BotFather | TELEGRAM_BOT_TOKEN, TELEGRAM_P24_CLAUDE_BOT_API_KEY | web.telegram.org/k/#@BotFather | telegram-bot-token-rotation.md |
| Claude OAuth (vps-i1 + bms-4 claude-runner) | OAuth session token | Google OAuth flow | claude-runner-oauth-rotation.md |
| n8n BMS-4 API key | BMS4_N8N_API_KEY | n8n.bms-4.infra.zintegrowana.online/settings/api (REST API returns 404 in 2.26.x) | n8n/n8n-bms4-api-key-rotation.md · scripts/rotate/n8n-bms4-api-key.js + .ps1 |
| GitHub PAT | GH_TOKEN, GITHUB_PAT_ALL_WRITES, GITHUB_PAT_P24_INFRA | github.com/settings/personal-access-tokens (+ TOTP via GITHUB_TOTP_SECRET) — bms-4 only, headless, no persistent profile | github-pat-rotation.md · scripts/rotate/github-pat.js (#4069) |
| HeyGen | HEYGEN_API_KEY | app.heygen.com | heygen-api-key-rotation.md |
| ClickUp | CLICKUP_API_KEY | app.clickup.com | clickup-api-key-rotation.md |
Manual only — human must act at provider dashboard
Claude cannot automate these. A GH issue (human-action label) is created automatically when rotation is due.
| Service | Key(s) | Reason | Playbook |
|---|---|---|---|
| Vercel Token (team-scoped) | VERCEL_TOKEN | No API to create new token with existing token | vercel-token-rotation.md |
| Cloudflare Global Key | CF_GLOBAL_API_KEY | No rotation API | cloudflare-credential-rotation.md |
| Wasabi Admin Key | WASABI_ADMIN_ACCESS_KEY | Console UI only, no IAM self-rotation | wasabi-key-rotation.md |
| Server root passwords | BMS root creds | passwd requires interactive TTY | mongodb-credential-rotation.md |
| AGE master key | AGE_KEY_GHA | Requires age-keygen + sops updatekeys + manual secret update | docs/playbooks/master-keys-bootstrap.md |
| LinkedIn OAuth | LINKEDIN_ACCESS_TOKEN | Browser OAuth flow — monthly | brand-credential-rotation.md |
| OVH Consumer Keys | OVH_CONSUMER_KEY | OVH OAuth requires browser authorization | N/A — create new app |
Template for new entries
When adding a new service credential to the ecosystem, add a row here under the correct section. Then create or link its individual rotation playbook.
| **Service Name** | `KEY_NAME` | admin credential or method | `secrets/file.env.sops` | [`playbook-name.md`](playbook-name.md) |