p24-infra Docs

google-oauth-credential-rotation

3 min read

Playbook: Google OAuth & GCP Credential Rotation

Covers: GOOGLE_CLIENT_ID/SECRET · GOOGLE_OAUTH_WEB_CLIENT_ID/SECRET · GOOGLE_ADS_* · GCP_SA_KEY_JSON

Overview

Four separate sets of Google/GCP credentials across different projects — all ❌ Tier 3 Manual:

Credential setSOPS fileService
GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRETn8n-bms4Google OAuth (n8n integrations)
GOOGLE_OAUTH_WEB_CLIENT_ID / GOOGLE_OAUTH_WEB_CLIENT_SECRETwhatsupGoogle OAuth (p24-wa-a web app)
GOOGLE_ADS_DEVELOPER_TOKEN / GOOGLE_ADS_CLIENT_ID / GOOGLE_ADS_CLIENT_SECRET / GOOGLE_ADS_REFRESH_TOKENart-agencyGoogle Ads + OAuth
GCP_SA_KEY_JSONadministrationGCP Service Account JSON key

When to rotate

  • On exposure: immediately
  • Scheduled: annually or when GCP project is restructured
  • GOOGLE_ADS_REFRESH_TOKEN: when Google Ads workflows fail with invalid_grant

Rotation steps

GOOGLE_CLIENT_ID / GOOGLE_CLIENT_SECRET (n8n integrations)

1. Rotate in GCP Console (human required)

  1. https://console.cloud.google.com → select the project → APIs & Services → Credentials
  2. Under OAuth 2.0 Client IDs → select the n8n client → Reset Secret
  3. Copy new Client ID and Client Secret — shown once

2. Distribute (Claude handles)

Update secrets/n8n-bms4.env.sops — keys: GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET. Follow docs/playbooks/sops-edit-operations.md.

Restart n8n to pick up new env values:

ssh root@100.86.202.85 "cd /opt/n8n && docker compose restart n8n"

Also update the n8n credential vault if the Google credential is stored as an n8n OAuth object:

  • n8n UI → Credentials → find Google OAuth credential → update Client ID + Secret

GOOGLE_OAUTH_WEB_CLIENT_ID / GOOGLE_OAUTH_WEB_CLIENT_SECRET (p24-wa-a)

1. Rotate in GCP Console (human required)

Same steps as above — locate the web OAuth client for the p24-wa-a project. GCP Console → APIs & Services → Credentials → web client → Reset Secret.

2. Distribute (Claude handles)

Update secrets/whatsup.env.sops — keys: GOOGLE_OAUTH_WEB_CLIENT_ID, GOOGLE_OAUTH_WEB_CLIENT_SECRET. Restart p24-wa-a after deploy.

1. Rotate OAuth client (human required)

  • GOOGLE_ADS_CLIENT_ID / GOOGLE_ADS_CLIENT_SECRET: GCP Console → Credentials (same as above)
  • GOOGLE_ADS_DEVELOPER_TOKEN: Google Ads Console → Tools → API Center → Developer Token (requires Manager account; token approval involves a manual Google review process)

2. Renew refresh token

GOOGLE_ADS_REFRESH_TOKEN is obtained via browser OAuth 2.0 flow:

  1. Use the new Client ID/Secret to initiate the Google Ads OAuth consent flow in a browser
  2. Authorize with the Ads Manager account → capture refresh_token from the callback (use an OAuth 2.0 playground or a local helper script — never paste the token in chat)

3. Distribute (Claude handles)

Update secrets/art-agency.env.sops:

  • Keys: GOOGLE_ADS_DEVELOPER_TOKEN, GOOGLE_ADS_CLIENT_ID, GOOGLE_ADS_CLIENT_SECRET, GOOGLE_ADS_REFRESH_TOKEN

Follow docs/playbooks/sops-edit-operations.md.

GCP_SA_KEY_JSON (service account)

1. Create new key (human required)

  1. GCP Console → IAM & Admin → Service Accounts → select the p24-infra service account
  2. Keys tab → Add Key → Create new key → JSON → download the file
  3. The JSON content is stored as the value of GCP_SA_KEY_JSON (typically inlined or base64-encoded)

2. Distribute (Claude handles)

Update secrets/administration.env.sops — key: GCP_SA_KEY_JSON.

3. Revoke old key

GCP Console → IAM → Service Accounts → select account → Keys → find old key by ID → Delete.

Log rotation

| YYYY-MM-DD HH:MM UTC | #ISSUE | GOOGLE_CLIENT_ID | reason | radieu | n8n-bms4.env.sops |

Recovery

If n8n Google workflows fail after rotation: verify the n8n credential vault was updated in addition to SOPS — n8n stores OAuth credentials separately from environment variables.

References

  • secret-rotation-access-matrix.md — Tier 3 classification
  • docs/playbooks/sops-edit-operations.md — SOPS write pattern

Graph View