p24-infra Docs

groq-credential-rotation

2 min read

Playbook: Groq API Key Rotation

Covers: GROQ_API_KEY

Overview

KeyCurrent locationPurpose
GROQ_API_KEY.env.local only — no SOPS entry yetGroq LLM API access for local development

Tier: ❌ Tier 3 Manual — Groq Console has no public key management API.

Important: GROQ_API_KEY is currently used for local development only. When it is first used in a production workflow (n8n on bms-4, a monitoring exporter, or any deployed service), it must be added to the appropriate SOPS file before deployment. See “Adding to SOPS” below.

When to rotate

  • On exposure: immediately
  • Scheduled: annually, or when moving from dev to production use
  • Create a separate dedicated key for production rather than reusing the dev key

Pre-rotation checklist

  • Check if any n8n workflows or deployed services currently use this key
  • If production use exists: determine the correct SOPS target file before proceeding

Rotation steps

1. Create new API key (human required)

  1. Log in to https://console.groq.com
  2. API Keys → Create API Key
  3. Name it descriptively: p24-dev-YYYY-MM (dev) or p24-n8n-bms4 (production)
  4. Copy the key immediately — shown once only (starts with gsk_)

2a. Update .env.local (development use)

# Replace key in .env.local without printing the value
$envPath = "C:\code_2026\p24-infra\.env.local"
$content = Get-Content $envPath
$updated = $content | ForEach-Object {
    if ($_ -match '^GROQ_API_KEY=') { "GROQ_API_KEY=$env:NEW_GROQ_KEY" } else { $_ }
}
[System.IO.File]::WriteAllText($envPath, ($updated -join "`n") + "`n", [System.Text.UTF8Encoding]::new($false))
$env:NEW_GROQ_KEY = ""

2b. Adding to SOPS (first time production use)

When a production workflow requires this key:

$env:SOPS_AGE_KEY_FILE = "C:\Users\konar\.age\p24-infra-keys.txt"
# Target file selection:
#   secrets/n8n-bms4.env.sops  — if used in n8n workflows on bms-4
#   secrets/monitoring.env.sops — if used in a monitoring exporter
# Follow sops-edit-operations.md to add GROQ_API_KEY to the chosen file
sops --decrypt --input-type dotenv --output-type dotenv secrets\n8n-bms4.env.sops | Out-Null
if ($LASTEXITCODE -ne 0) { throw "SOPS corrupt — do NOT commit" }

After adding to SOPS, update docs/playbooks/secret-rotation-access-matrix.md:

  • Change GROQ_API_KEY row: set SOPS file(s) from — to the actual SOPS file name.

3. Revoke old key

https://console.groq.com → API Keys → find old key → Delete.

4. Log rotation

| YYYY-MM-DD HH:MM UTC | #ISSUE | GROQ_API_KEY | reason | radieu | .env.local |

Recovery

If the new key doesn’t work: verify it was copied completely (starts with gsk_). Groq allows multiple active keys — create a second key as a temporary replacement while investigating.

References

  • secret-rotation-access-matrix.md — current storage note (— / .env.local only)
  • docs/playbooks/sops-edit-operations.md — SOPS write pattern (for production migration)

Graph View