JC Beasley
0bd719ab91
- Create patterns/ directory with README, manifest, and 10 initial patterns covering Ollama JSON fallback, API escaping, deprecation, PTY auth, queue-poll, LLM-as-parser, credential rotation, reverse proxy binding, human approval gates, and transient retry. - Wire pattern loading into architecture/pipeline.js based on task tags. - Update architecture/orchestrator.js to load patterns and surface them in the system prompt. - Update MEMORY.md, ARCHITECTURE.md, and CONTEXT.md to document the registry and record the decision.
32 lines
1.5 KiB
Markdown
32 lines
1.5 KiB
Markdown
# Pattern: Credential Rotation and External Service Breakage
|
|
|
|
## Symptom
|
|
An integration that previously worked starts failing with authentication errors, 401/403 responses, or "invalid token" messages. No code has changed. The root cause is an expired or rotated API key, AppRole secret, OAuth token, or vault credential.
|
|
|
|
## Affected Projects
|
|
- n8n workflows using AppRole or API keys
|
|
- NocoDB token-based integrations
|
|
- Any service using HashiCorp Vault AppRole authentication
|
|
|
|
## Root Cause
|
|
Credentials have finite lifetimes or rotation policies. If the integration has no renewal path and the credential is stored in only one place, expiry causes immediate breakage that looks like a code problem.
|
|
|
|
## Standard Fix
|
|
1. Store credentials in Vault, not in code, config files, or workflow nodes.
|
|
2. Document credential lifetime and rotation procedure in the project RUNBOOK.
|
|
3. Add health checks that verify credential validity without performing risky operations.
|
|
4. Where possible, implement token refresh or AppRole re-login rather than relying on static long-lived tokens.
|
|
5. Alert before expiry, not after.
|
|
|
|
## When to Apply
|
|
- Every new integration that uses an API key, token, password, or secret.
|
|
- Any existing integration that has no documented credential source or rotation plan.
|
|
|
|
## Verification
|
|
- Health check passes using the stored credential.
|
|
- Rotation procedure has been tested end-to-end.
|
|
- No secrets are committed to version control.
|
|
|
|
## Related Patterns
|
|
- `api-version-deprecation`
|