Manually rotate deployment tokens/secrets in Vercel and Railway environments. Use when the user asks to cycle or rotate API tokens, replace compromised secrets, or perform key rollover for deployed services.
Rotate environment tokens in deployed services with explicit manual confirmation.
Only run rotation when the user explicitly asks for it in the current turn. Default to dry-run previews and require explicit apply confirmation.
vercel or railway.env var or secure input path).Use scripts/rotate_vercel_env_token.sh.
Example dry-run:
./scripts/rotate_vercel_env_token.sh \
--project /path/to/project \
--token-name PAYMENT_GATEWAY_API_TOKEN \
--environment production \
--value-env NEW_PAYMENT_GATEWAY_API_TOKEN
Apply:
./scripts/rotate_vercel_env_token.sh \
--project /path/to/project \
--token-name PAYMENT_GATEWAY_API_TOKEN \
--environment production \
--value-env NEW_PAYMENT_GATEWAY_API_TOKEN \
--apply
Use scripts/rotate_railway_env_token.sh.
Service variable dry-run:
./scripts/rotate_railway_env_token.sh \
--project /path/to/project \
--service-name docsmith-payment-gateway \
--variable PAYMENT_GATEWAY_API_TOKEN \
--value-env NEW_PAYMENT_GATEWAY_API_TOKEN
Service variable apply:
./scripts/rotate_railway_env_token.sh \
--project /path/to/project \
--service-name docsmith-payment-gateway \
--variable PAYMENT_GATEWAY_API_TOKEN \
--value-env NEW_PAYMENT_GATEWAY_API_TOKEN \
--apply
Shared variable apply:
./scripts/rotate_railway_env_token.sh \
--project /path/to/project \
--shared \
--variable LICENSING_API_TOKEN \
--value-env NEW_LICENSING_API_TOKEN \
--apply
references/commands.md for command notes and guardrails.scripts/rotate_vercel_env_token.sh for Vercel env token rotation.scripts/rotate_railway_env_token.sh for Railway env token rotation.