[object Object]

← back to Coming Soon Template

migrate GoDaddy auth → Bearer PAT (TK-10 key rotation); sso-key fallback retained

c5074853f89c989c8132571f3111a12951622ebe · 2026-07-27 20:04:55 -0700 · Steve Abrams

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

Diff

commit c5074853f89c989c8132571f3111a12951622ebe
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Mon Jul 27 20:04:55 2026 -0700

    migrate GoDaddy auth → Bearer PAT (TK-10 key rotation); sso-key fallback retained
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 scripts/godaddy_ns_api.js  | 7 +++++--
 scripts/godaddy_ns_flip.sh | 5 ++++-
 viewer/server.js           | 5 ++++-
 3 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/scripts/godaddy_ns_api.js b/scripts/godaddy_ns_api.js
index 4cef9d9..5c11cf9 100644
--- a/scripts/godaddy_ns_api.js
+++ b/scripts/godaddy_ns_api.js
@@ -30,12 +30,15 @@ function envVal(key) {
 }
 const GD_KEY = envVal('GODADDY_API_KEY');
 const GD_SECRET = envVal('GODADDY_API_SECRET');
+const GD_PAT = envVal('GODADDY_PAT');
 const CF_TOK = envVal('CLOUDFLARE_API_TOKEN');
 const ACCT = envVal('CLOUDFLARE_ACCOUNT_ID');
-if (!GD_KEY || !GD_SECRET) { console.error('missing GODADDY_API_KEY / GODADDY_API_SECRET in', ENV); process.exit(1); }
+if (!GD_PAT && (!GD_KEY || !GD_SECRET)) { console.error('missing GODADDY_PAT or GODADDY_API_KEY / GODADDY_API_SECRET in', ENV); process.exit(1); }
 
 const GD = 'https://api.godaddy.com/v1';
-const GD_HEADERS = { 'Authorization': `sso-key ${GD_KEY}:${GD_SECRET}`, 'Content-Type': 'application/json' };
+// Prefer a Bearer PAT when present (TK-10 key rotation); else legacy sso-key.
+const GD_AUTH = GD_PAT ? `Bearer ${GD_PAT}` : `sso-key ${GD_KEY}:${GD_SECRET}`;
+const GD_HEADERS = { 'Authorization': GD_AUTH, 'Content-Type': 'application/json' };
 const APPLY = process.argv.includes('--apply');
 
 async function gd(method, urlPath, body) {
diff --git a/scripts/godaddy_ns_flip.sh b/scripts/godaddy_ns_flip.sh
index f0663bd..3cb3f6d 100755
--- a/scripts/godaddy_ns_flip.sh
+++ b/scripts/godaddy_ns_flip.sh
@@ -8,6 +8,9 @@ set -uo pipefail
 ENV=~/Projects/secrets-manager/.env
 KEY=$(grep '^GODADDY_API_KEY=' "$ENV" | cut -d= -f2)
 SEC=$(grep '^GODADDY_API_SECRET=' "$ENV" | cut -d= -f2)
+# Prefer a Bearer PAT when present (TK-10 key rotation); else legacy sso-key.
+GD_PAT="${GODADDY_PAT:-$(grep '^GODADDY_PAT=' "$ENV" | cut -d= -f2-)}"
+if [ -n "$GD_PAT" ]; then GD_AUTH="Bearer $GD_PAT"; else GD_AUTH="sso-key $KEY:$SEC"; fi
 CST=~/Projects/coming-soon-template
 IN="$CST/data/zone-setup.json"
 APPLY=0; [ "${1:-}" = "--apply" ] && APPLY=1
@@ -26,7 +29,7 @@ python3 -c 'import json;[print(z["domain"]+"\t"+",".join(z.get("cf_ns",[]))+"\t"
   if [ $APPLY -eq 1 ]; then
     code=$(curl -s -o /tmp/gd_resp -w '%{http_code}' -X PATCH \
       "https://api.godaddy.com/v1/domains/$d" \
-      -H "Authorization: sso-key $KEY:$SEC" -H "Content-Type: application/json" \
+      -H "Authorization: $GD_AUTH" -H "Content-Type: application/json" \
       --data "$body")
     if [ "$code" = "200" ] || [ "$code" = "204" ]; then
       echo "FLIP  $d  -> $ns  [HTTP $code]"
diff --git a/viewer/server.js b/viewer/server.js
index cd5fac4..5227480 100644
--- a/viewer/server.js
+++ b/viewer/server.js
@@ -24,6 +24,9 @@ function envVal(key) {
 }
 const GD_KEY = envVal('GODADDY_API_KEY');
 const GD_SECRET = envVal('GODADDY_API_SECRET');
+const GD_PAT = envVal('GODADDY_PAT');
+// Prefer a Bearer PAT when present (TK-10 key rotation); else legacy sso-key.
+const GD_AUTH = GD_PAT ? `Bearer ${GD_PAT}` : `sso-key ${GD_KEY}:${GD_SECRET}`;
 
 const readJSON = (p, fb) => { try { return JSON.parse(fs.readFileSync(path.join(ROOT, p), 'utf8')); } catch { return fb; } };
 const isCfNs = ns => Array.isArray(ns) && ns.length > 0 && ns.every(h => /\.ns\.cloudflare\.com$/i.test(h));
@@ -31,7 +34,7 @@ const isCfNs = ns => Array.isArray(ns) && ns.length > 0 && ns.every(h => /\.ns\.
 async function godaddyNs(domain) {
   try {
     const res = await fetch(`https://api.godaddy.com/v1/domains/${domain}`, {
-      headers: { 'Authorization': `sso-key ${GD_KEY}:${GD_SECRET}` },
+      headers: { 'Authorization': GD_AUTH },
     });
     const j = await res.json();
     return { ns: j.nameServers || [], status: j.status || 'UNKNOWN' };

← adad0b4 Add rel=noopener noreferrer to all target=_blank links in vi  ·  back to Coming Soon Template  ·  (newest)