[object Object]

← back to Kravet Sheet Sync 2026 04 20

Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice

27bf3ca298cfc4ffafffe21678ebafbfca7b2524 · 2026-07-16 09:59:12 -0700 · Steve Abrams

Files touched

Diff

commit 27bf3ca298cfc4ffafffe21678ebafbfca7b2524
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Jul 16 09:59:12 2026 -0700

    Strip hardcoded Shopify API tokens from source (env-first); no rotation/deploy — response to Shopify exposed-credentials notice
---
 attach_images.py             | 2 +-
 audit_last_30.py             | 2 +-
 build_dwkk_variant_map.py    | 2 +-
 bulk_push_v1.py              | 2 +-
 delete_collision_pilots.py   | 2 +-
 fix_audit_issues.py          | 2 +-
 fix_pilot_variants.py        | 2 +-
 fix_test_images.py           | 2 +-
 kravet_finalize.py           | 2 +-
 price_update_pass.py         | 2 +-
 test_push_2_items.py         | 2 +-
 test_push_fix_variants.py    | 2 +-
 test_push_metafields_only.py | 2 +-
 13 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/attach_images.py b/attach_images.py
index e6b2f87..4f894e5 100644
--- a/attach_images.py
+++ b/attach_images.py
@@ -5,7 +5,7 @@ URL pattern: https://www.kravet.com/media/catalog/product + {sheet.image_file_hi
 """
 import json, subprocess, urllib.request, urllib.error
 
-TOKEN = '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'
+TOKEN = os.environ.get('SHOPIFY_ADMIN_TOKEN','')
 URL   = 'https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/graphql.json'
 KRAVET_BASE = 'https://www.kravet.com/media/catalog/product'
 
diff --git a/audit_last_30.py b/audit_last_30.py
index 1e662f1..bd57769 100644
--- a/audit_last_30.py
+++ b/audit_last_30.py
@@ -17,7 +17,7 @@ Emits a pass/fail summary + detailed issue list per product.
 """
 import json, subprocess, urllib.request, io, csv, sys
 
-TOKEN='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'
+TOKEN=os.environ.get('SHOPIFY_ADMIN_TOKEN','')
 URL='https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/graphql.json'
 SSH=['ssh','root@45.61.58.125']
 NEW_ARRIVALS_GID='gid://shopify/Collection/167327760435'
diff --git a/build_dwkk_variant_map.py b/build_dwkk_variant_map.py
index 1ffdf7d..3f2942c 100644
--- a/build_dwkk_variant_map.py
+++ b/build_dwkk_variant_map.py
@@ -6,7 +6,7 @@ Persists to PG: kravet_dwkk_variant_map (dw_sku, product_gid, variant_gid, price
 """
 import json, subprocess, time, urllib.request
 
-TOKEN='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'
+TOKEN=os.environ.get('SHOPIFY_ADMIN_TOKEN','')
 URL='https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/graphql.json'
 SSH=['ssh','root@45.61.58.125']
 
diff --git a/bulk_push_v1.py b/bulk_push_v1.py
index 0e690c9..4064839 100644
--- a/bulk_push_v1.py
+++ b/bulk_push_v1.py
@@ -21,7 +21,7 @@ Run:
 import argparse, json, re, subprocess, sys, time, urllib.request
 from concurrent.futures import ThreadPoolExecutor, as_completed
 
-TOKEN = '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'
+TOKEN = os.environ.get('SHOPIFY_ADMIN_TOKEN','')
 SHOP  = 'designer-laboratory-sandbox.myshopify.com'
 GQL   = f'https://{SHOP}/admin/api/2024-10/graphql.json'
 SSH   = ['ssh', 'root@45.61.58.125']
diff --git a/delete_collision_pilots.py b/delete_collision_pilots.py
index 3bb49fe..67341c7 100644
--- a/delete_collision_pilots.py
+++ b/delete_collision_pilots.py
@@ -2,7 +2,7 @@
 """Delete the 5 DWKK-collision pilot products + clean PG rows."""
 import json, urllib.request, subprocess
 
-TOKEN='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'
+TOKEN=os.environ.get('SHOPIFY_ADMIN_TOKEN','')
 URL='https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/graphql.json'
 
 # Collision pilots — the NEW product IDs (keep the OLD existing ones untouched)
diff --git a/fix_audit_issues.py b/fix_audit_issues.py
index 8072e1c..f0618ee 100644
--- a/fix_audit_issues.py
+++ b/fix_audit_issues.py
@@ -7,7 +7,7 @@ Fix issues from audit_last_30:
 """
 import json, os, subprocess, urllib.request, urllib.parse
 
-TOKEN='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'
+TOKEN=os.environ.get('SHOPIFY_ADMIN_TOKEN','')
 SHOP='designer-laboratory-sandbox.myshopify.com'
 URL=f'https://{SHOP}/admin/api/2024-10/graphql.json'
 NEW_ARRIVALS='gid://shopify/Collection/167327760435'
diff --git a/fix_pilot_variants.py b/fix_pilot_variants.py
index 4b7eece..6b2d741 100644
--- a/fix_pilot_variants.py
+++ b/fix_pilot_variants.py
@@ -2,7 +2,7 @@
 """Add missing main-sell variant to 10 pilot products."""
 import json, urllib.request, subprocess, io, csv
 
-TOKEN='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'
+TOKEN=os.environ.get('SHOPIFY_ADMIN_TOKEN','')
 URL='https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/graphql.json'
 
 def gql(q,v=None):
diff --git a/fix_test_images.py b/fix_test_images.py
index bdbaac5..4f00f6d 100644
--- a/fix_test_images.py
+++ b/fix_test_images.py
@@ -2,7 +2,7 @@
 """Replace placeholder images on the 2 test products with real Brandfolder URLs."""
 import json, urllib.request
 
-TOKEN='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'
+TOKEN=os.environ.get('SHOPIFY_ADMIN_TOKEN','')
 URL='https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/graphql.json'
 
 FIXES = [
diff --git a/kravet_finalize.py b/kravet_finalize.py
index 9691d67..e0da1cc 100644
--- a/kravet_finalize.py
+++ b/kravet_finalize.py
@@ -16,7 +16,7 @@ Usage:
 """
 import json, re, subprocess, sys, urllib.request, argparse
 
-TOKEN = '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'
+TOKEN = os.environ.get('SHOPIFY_ADMIN_TOKEN','')
 SHOP  = 'designer-laboratory-sandbox.myshopify.com'
 GQL   = f'https://{SHOP}/admin/api/2024-10/graphql.json'
 SSH   = ['ssh', 'root@45.61.58.125']
diff --git a/price_update_pass.py b/price_update_pass.py
index 3bf422c..78c99ea 100644
--- a/price_update_pass.py
+++ b/price_update_pass.py
@@ -23,7 +23,7 @@ import argparse, json, os, subprocess, sys, time, urllib.request
 from concurrent.futures import ThreadPoolExecutor, as_completed
 import io, csv, threading
 
-TOKEN='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'
+TOKEN=os.environ.get('SHOPIFY_ADMIN_TOKEN','')
 URL='https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/graphql.json'
 SSH=['ssh','root@45.61.58.125']
 OUT_JSONL='price_update_results.jsonl'
diff --git a/test_push_2_items.py b/test_push_2_items.py
index a4e0437..c0664d5 100644
--- a/test_push_2_items.py
+++ b/test_push_2_items.py
@@ -21,7 +21,7 @@ import urllib.request
 import urllib.error
 
 SHOP   = "designer-laboratory-sandbox.myshopify.com"
-TOKEN  = "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"
+TOKEN  = os.environ.get('SHOPIFY_ADMIN_TOKEN','')
 API    = "2024-10"
 GQL_URL = f"https://{SHOP}/admin/api/{API}/graphql.json"
 
diff --git a/test_push_fix_variants.py b/test_push_fix_variants.py
index 1b254b2..7a6d57f 100644
--- a/test_push_fix_variants.py
+++ b/test_push_fix_variants.py
@@ -5,7 +5,7 @@ Target: add a second variant with the DWKK main SKU + MAP price + cost.
 """
 import json, urllib.request
 
-TOKEN='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'
+TOKEN=os.environ.get('SHOPIFY_ADMIN_TOKEN','')
 URL='https://designer-laboratory-sandbox.myshopify.com/admin/api/2024-10/graphql.json'
 
 MAIN_VARIANTS = [
diff --git a/test_push_metafields_only.py b/test_push_metafields_only.py
index 90e5c5d..03b59bd 100644
--- a/test_push_metafields_only.py
+++ b/test_push_metafields_only.py
@@ -3,7 +3,7 @@
 import json, urllib.request, subprocess
 
 SHOP   = "designer-laboratory-sandbox.myshopify.com"
-TOKEN  = "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"
+TOKEN  = os.environ.get('SHOPIFY_ADMIN_TOKEN','')
 API    = "2024-10"
 GQL_URL = f"https://{SHOP}/admin/api/{API}/graphql.json"

← b3fd109 auto-save: 2026-07-14T08:29:59 (14 files) — attach_images.py  ·  back to Kravet Sheet Sync 2026 04 20  ·  auto-save: 2026-07-17T19:47:29 (1 files) — __pycache__/ 9f79453 →