update shopify credential status — 6755 live + routed, revoke 7d19 remains

89e7b0f8ff31036916c3c5381bf6c983c51cc0f4 · 2026-09-23 09:43:10 -0700 · Steve Abrams

Files touched

M data/credentials.json

Diff

commit 89e7b0f8ff31036916c3c5381bf6c983c51cc0f4
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Wed Sep 23 09:43:10 2026 -0700

    update shopify credential status — 6755 live + routed, revoke 7d19 remains
---
 data/credentials.json | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/data/credentials.json b/data/credentials.json
index c296578..dae4e93 100644
--- a/data/credentials.json
+++ b/data/credentials.json
@@ -70,18 +70,18 @@
     },
     {
       "id": "shopify-admin-token",
-      "title": "SHOPIFY_ADMIN_TOKEN (7d19)",
-      "priority": "P2",
-      "status": "OUTSTANDING",
+      "title": "SHOPIFY_ADMIN_TOKEN (revoke leaked 7d19)",
+      "priority": "P1",
+      "status": "IN PROGRESS",
       "class": "console-mint",
       "created_at": "2026-09-22T00:00:00-07:00",
-      "exposed": "TK-12015 (2026-09-22): token shpat_…7d19 (app '81026 API') LEAKED via a pm2 env dump pasted into a Claude session, and is CONFIRMED STILL LIVE (HTTP 200). 'Verified working' is NOT 'rotated' — a live leaked token is an outstanding rotation. Contained (private paste, not committed/public), rotate as hygiene.",
+      "exposed": "TK-12015 (2026-09-22): token shpat_…7d19 (app '81026 API', Dev Dashboard) LEAKED via pm2 env dump. NEW token shpat_…6755 (custom app, STORE ADMIN) minted 2026-09-23, verified LIVE (HTTP 200), routed locally + deployed to Kamatera prod. Fleet now runs on 6755. BUT: the OLD leaked 7d19 is STILL LIVE — uninstalling the '81026 API' app REVOKES it (zero downtime, fleet already on 6755).",
       "runbook": "~/.claude/yolo-queue/pending-approval/TK-12015-rotate-shopify-admin-token-7d19.md",
-      "mint_url": "https://admin.shopify.com (Dev Dashboard app → INSTALL on designer-laboratory-sandbox to mint shpat_)",
-      "console_steps": "BLOCKED on Shopify UI: create/use an app with EXACTLY read/write_products + read/write_publications, then INSTALL it on designer-laboratory-sandbox to mint the shpat_ token (the missing step). Custom-app API access is currently OFF on the store — re-enable it OR install a backed app. Best done in Claude Desktop (browser control). ~5 min in a fresh session.",
-      "route_back": "printf 'SHOPIFY_ADMIN_TOKEN=<NEW_TOKEN>' | node ~/Projects/secrets-manager/cli.js import-paste",
-      "verify": "node ~/Projects/secrets-manager/cli.js check",
-      "why": "Live leaked admin token (read/write products+publications). Corrected 2026-09-23 from a stale 'RESOLVED' that measured 'works' not 'rotated' — the TK-11431 false-green class."
+      "mint_url": null,
+      "console_steps": "Shopify store admin → Settings → Apps → Develop apps → find '81026 API' → uninstall. Then re-test: curl -s -H 'X-Shopify-Access-Token: shpat_…7d19' https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/shop.json → expect 401 (token dead).",
+      "route_back": "(NEW token already routed 2026-09-23; only revoke remains)",
+      "verify": "curl -s -H 'X-Shopify-Access-Token: shpat_…7d19' https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/shop.json — expect {\"errors\":\"[API] Invalid API key or access token\"} (HTTP 401)",
+      "why": "Leaked token MUST be revoked, not just replaced. The fleet is safe on 6755. Uninstalling '81026 API' kills 7d19 cleanly with NO downtime."
     }
   ]
 }

← fffe6ab fix credentials dashboard: Shopify token RESOLVED→OUTSTANDIN · back to Credentials Agentabrams · add 4-way view switcher (list/grid/table/kv) + search to cre 3bd0c68 →