Credential Guardian

When to Use

Use when investigating authentication failures, rotating API keys, auditing credential locations, or preventing silent outages from expired tokens. Covers all external service credentials (PayPal, Kie.ai, Gemini, R2, Aitable, Apify, Resend, Firebase, WAHA, GoLogin (deprecated — FB Bot killed Mar 19 2026)). Not for video pipeline logic, UI design, schema changes, or migrations.

Critical Rules

1. Never commit credentials to git. Check .gitignore before any .env file changes.
2. Credentials live in FOUR locations: Vercel dashboard (web), RackNerd .env (worker), ~/.cursor/mcp.json (MCP), infra/*.env (services).
3. Shared keys must be updated in ALL locations: DATABASE_URL, KIE_API_KEY, PAYPAL_CLIENT_ID exist in multiple places.
4. Most API keys don't expire, but OAuth tokens do (Vercel OIDC, NotebookLM).
5. Test after rotation: Run health checks to verify new keys work before removing old ones.

Architecture