API credentials hygiene: env vars, rotation, least privilege, auditability

API credentials hygiene: env vars, rotation, least privilege, auditability

PURPOSE

Audits and hardens API credential handling (env vars, separation, rotation plan, least privilege, auditability).

WHEN TO USE

• TRIGGERS:
  • Harden the credentials setup for this integration and move secrets into env vars.
  • Design a key rotation plan for these APIs with minimal downtime.
  • Audit this service for least-privilege access and document what each key can do.
  • Create an environment variable map and a secure .env template for this project.
  • Set up credential separation for dev versus prod with clear audit trails.
• DO NOT USE WHEN…
  • You want to obtain keys without authorization or bypass security controls.
  • You need legal/compliance sign-off (this outputs technical documentation, not legal advice).

INPUTS

• REQUIRED:
  • List of integrations/APIs and where credentials are currently stored/used.
  • Deployment context (local dev, server, container, n8n, etc.).
• OPTIONAL:
  • Current config files/redacted snippets (.env, compose, systemd, n8n creds list).
  • Org rules (rotation intervals, secret manager preference).
• EXAMPLES:
  • “Keys are hard-coded in a Node script and an n8n HTTP Request node.”
  • “We have dev and prod n8n instances and need separation.”

OUTPUTS

• Credential map (service → env vars → scopes/permissions → owner → rotation cadence).
• Rotation runbook (steps + rollback).
• Least-privilege checklist and audit log plan.
• Optional: .env template (placeholders only). Success = no secrets committed or embedded, permissions minimized, rotation steps documented, and auditability defined.

WORKFLOW

1. Inventory credentials:
   • where stored, where used, and who owns them.
2. Define separation:
   • dev vs prod; human vs service accounts; per-integration boundaries.