Playbook: SENTRY_AUTH_TOKEN Rotation

Service: Sentry (sentry.io)
Secret: SENTRY_AUTH_TOKEN
Rotation frequency: 90 days
Last rotated: 2026-05-03
Next due: 2026-08-01
Token type: sntryu_ — Sentry User Auth Token (UI-only creation; cannot be created via API)

What uses this token

Consumer	How	Effect if missing
Vercel build (et-operational-platform)	`SENTRY_AUTH_TOKEN` env var — `@sentry/nextjs` uploads source maps	Stack traces show minified code in Sentry; errors still captured

Note: GH Secret SENTRY_AUTH_TOKEN re-added to radieu/p24-infra on 2026-06-27 (PR #1667) alongside SOPS coverage. Token also lives in Vercel env vars for et-operational-platform.

Where the token is stored

Location	How to update
`secrets/monitoring.env.sops`	Follow SOPS write pattern in CLAUDE.md; canary decrypt before `git add`
`.env.local` on dev workstation (`d:\code_2026\p24-infra\.env.local`)	Edit line `SENTRY_AUTH_TOKEN=<new_token>` using `[System.IO.File]::WriteAllText`
Vercel env vars — `et-operational-platform` project	Vercel dashboard or `vercel env rm SENTRY_AUTH_TOKEN production && vercel env add`
GH Secret `SENTRY_AUTH_TOKEN` in `radieu/p24-infra`	`gh secret set SENTRY_AUTH_TOKEN --repo radieu/p24-infra`

Important: API limitation

Sentry sntryu_ User Auth Tokens cannot be created via the Sentry REST API.
The /api/0/api-tokens/ endpoint is for legacy internal integration tokens (different format).
The /api/0/users/me/user-tokens/ endpoint returns 404 for this token type.

This rotation is a mandatory human action — it cannot be automated.

Token scopes required

When creating the new token at sentry.io → User Settings → Auth Tokens:

Scope	Why
`project:releases`	Create and update releases, upload source maps
`org:read`	Read org info required by Sentry CLI
`project:read`	(Optional) Read project details; current token has this

Minimum viable: project:releases + org:read

Rotation steps

Step 1 — Create new token in Sentry UI
  URL: https://sentry.io/settings/auth-tokens/
  Name: p24-infra-cicd-<YYYY-MM-DD>
  Scopes: project:releases, org:read
  → Click "Create Token"
  → Copy value immediately (shown only once; starts with sntryu_)

Step 2 — Update secrets/monitoring.env.sops (SOPS write pattern)
  $env:SOPS_AGE_KEY_FILE = "C:\Users\konar\.age\p24-infra-keys.txt"
  $plain = sops --decrypt --input-type dotenv --output-type dotenv secrets\monitoring.env.sops
  $tempPath = "$PWD\secrets\monitoring-edit.env.sops"
  $env:NEW_TOKEN = "<value-from-step-1>"
  $updated = $plain -replace "^SENTRY_AUTH_TOKEN=.*", "SENTRY_AUTH_TOKEN=$env:NEW_TOKEN"
  [System.IO.File]::WriteAllText($tempPath, ($updated -join "`n") + "`n", [System.Text.UTF8Encoding]::new($false))
  $enc = sops --encrypt --input-type dotenv --output-type dotenv $tempPath
  [System.IO.File]::WriteAllText("$PWD\secrets\monitoring.env.sops", ($enc -join "`n") + "`n", [System.Text.UTF8Encoding]::new($false))
  sops --decrypt --input-type dotenv --output-type dotenv secrets\monitoring.env.sops | Out-Null  # canary
  [System.IO.File]::Delete($tempPath); $env:NEW_TOKEN = ""

Step 3 — Update .env.local on dev workstation
  # Edit d:\code_2026\p24-infra\.env.local
  # Change: SENTRY_AUTH_TOKEN=<NEW_TOKEN>

Step 4 — Update Vercel env var in et-operational-platform
  $env:NEW_TOKEN = "<NEW_TOKEN>"
  # Via Vercel CLI (run in et-operational-platform repo):
  vercel env rm SENTRY_AUTH_TOKEN production
  Write-Output $env:NEW_TOKEN | vercel env add SENTRY_AUTH_TOKEN production
  # Or via Vercel dashboard:
  #   https://vercel.com/radieu/et-operational-platform/settings/environment-variables
  #   → update SENTRY_AUTH_TOKEN for all environments

Step 5 — Verify new token works
  $env:NEW_TOKEN = "<NEW_TOKEN>"
  $r = Invoke-RestMethod "https://sentry.io/api/0/" `
      -Headers @{ Authorization = "Bearer $env:NEW_TOKEN" }
  $r.auth.scopes  # Expected: includes project:releases, org:read
  $env:NEW_TOKEN = ""

Step 6 — Trigger a CI build to confirm source maps upload
  # After next Vercel deployment, check build logs for:
  #   [sentry] Uploaded source maps for release <sha>
  # And check Sentry → et-operational-platform → Releases for a new entry

Step 7 — Revoke old token
  # In Sentry UI:
  https://sentry.io/settings/auth-tokens/
  → Find token named p24-infra-cicd-<OLD_DATE> → Revoke

Step 8 — Append to docs/secrets-rotation-log.md (newest first, after header):
  | <YYYY-MM-DD HH:MM UTC> | — | SENTRY_AUTH_TOKEN | scheduled 90d rotation | radieu | GH Secret + .env.local + Vercel (et-operational-platform) |

Step 8b — Log the operation to infra_operations audit log:
  # Source log_op.sh from the repo, then call log_op
  # On Windows PowerShell (local dev machine):
  $env:SOPS_AGE_KEY_FILE = "C:\Users\konar\.age\p24-infra-keys.txt"
  $env:SUPABASE_URL = (Get-Content d:\code_2026\p24-infra\.env.local | Select-String "^SUPABASE_URL=").ToString().Split("=",2)[1]
  $env:SUPABASE_SERVICE_KEY = (Get-Content d:\code_2026\p24-infra\.env.local | Select-String "^SUPABASE_SERVICE_KEY=").ToString().Split("=",2)[1]
  python d:\code_2026\p24-infra\scripts\lib\log_op.py  # (or use the bash wrapper on Linux)
  # Bash equivalent (on Linux / VPS):
  # source /opt/p24-infra/scripts/lib/log_op.sh
  # log_op "radieu" "credential_rotation" "SENTRY_AUTH_TOKEN" "success" \
  #   "Scheduled 90d rotation — new sntryu_ token scoped project:releases + org:read" "ci"

Step 9 — Update next_due in this playbook and in docs/sentry-operations.md § 3:
  sed -i 's/Next due: .*/Next due: <DATE+90d>/' docs/playbooks/sentry-token-rotation.md
  # Update "Last rotated" and "Next due" in docs/sentry-operations.md § 3

Verification after rotation

# 1. SOPS updated (SENTRY_AUTH_TOKEN present)
$env:SOPS_AGE_KEY_FILE = "C:\Users\konar\.age\p24-infra-keys.txt"
(sops --decrypt --input-type dotenv --output-type dotenv secrets\monitoring.env.sops | Select-String "^SENTRY_AUTH_TOKEN=") -ne $null
 
# 2. New token valid
$env:T = (Get-Content "d:\code_2026\p24-infra\.env.local" |
    Select-String "^SENTRY_AUTH_TOKEN=").ToString().Split("=",2)[1].Trim()
$r = Invoke-RestMethod "https://sentry.io/api/0/" -Headers @{Authorization="Bearer $env:T"}
Write-Host "Scopes: $($r.auth.scopes)"
$env:T = ""
 
# 3. Check Vercel deployment logs (after next deploy)
vercel logs --project et-operational-platform | Select-String "sentry"

Escalation path

Symptom	Action
Source maps not uploading after rotation	Check Vercel env var in et-operational-platform project; confirm it matches GH Secret
Sentry release not created in CI	Check GH Actions log for the release step; confirm `SENTRY_AUTH_TOKEN` secret is set
401 from Sentry API	Token may have been revoked before update; create emergency replacement token in UI
Stack traces show minified code	Source map upload failed — check Sentry project settings for upload errors

Prevention

Calendar reminder: add 90-day recurring reminder from last-rotated date
The credential-rotation.yml GH Actions workflow (Monday 06:00 UTC) opens a human-action issue when next_due passes. Confirm this entry is in the workflow’s key list.
Sentry does not send expiry warnings for User Auth Tokens — only the calendar reminder and GH Actions check trigger rotation.

p24-infra Docs

Explorer

sentry-token-rotation