# Pattern: Credential Rotation and External Service Breakage

## Symptom
An integration that previously worked starts failing with authentication errors, 401/403 responses, or "invalid token" messages. No code has changed. The root cause is an expired or rotated API key, AppRole secret, OAuth token, or vault credential.

## Affected Projects
- n8n workflows using AppRole or API keys
- NocoDB token-based integrations
- Any service using HashiCorp Vault AppRole authentication

## Root Cause
Credentials have finite lifetimes or rotation policies. If the integration has no renewal path and the credential is stored in only one place, expiry causes immediate breakage that looks like a code problem.

## Standard Fix
1. Store credentials in Vault, not in code, config files, or workflow nodes.
2. Document credential lifetime and rotation procedure in the project RUNBOOK.
3. Add health checks that verify credential validity without performing risky operations.
4. Where possible, implement token refresh or AppRole re-login rather than relying on static long-lived tokens.
5. Alert before expiry, not after.

## When to Apply
- Every new integration that uses an API key, token, password, or secret.
- Any existing integration that has no documented credential source or rotation plan.

## Verification
- Health check passes using the stored credential.
- Rotation procedure has been tested end-to-end.
- No secrets are committed to version control.

## Related Patterns
- `api-version-deprecation`