# 🤖 Secrets inventory

The authoritative list of every server-side secret in the system (issue #550
Part 12, operability item 11), with what each one authorizes, where it lives,
its blast radius, and how to rotate it. Update this doc in the same PR that
adds or retires a secret.

**The boundary that matters most is what's *not* here.** User keypairs, thread
keys, and the instance key are client-side only — the server never holds them,
so they can't appear in this inventory. Every secret below is *auth plumbing*:
compromising it lets an attacker impersonate infrastructure or vandalize
state, but never decrypt a message. (The two scoped exceptions are bot
identity keys and the Anthropic key, held by sidecars — machines that are
deliberately *members*, never the server.)

Operator-specific locations (which box, which env file, which 1Password item)
live in `CLAUDE.local.md` and 1Password, not here. The storage and recovery
scheme for these secrets — the sealed vault repo, and why it is deliberately
private — is `docs/secrets-vault.md`.

## Per-instance

- **Admin token** (`LCHAT_ADMIN_TOKEN`) — authorizes roster management and the
  admin console; explicitly not a decryption key. Server stores only its
  hash. Lives in the instance's deployment env + 1Password. *Blast radius*:
  one instance's membership (add/remove members, invites) — not its content.
  *Rotate*: set a new token in the env and restart; saved admin links die,
  recover with `lchat admin-link`.
- **Push relay token** (`LCHAT_PUSH_RELAY_TOKEN`) — bearer auth to the APNs
  relay. *Blast radius*: can send junk pushes as that instance. *Rotate*:
  mint a replacement via the relay's admin API, swap the env, restart, revoke
  the old — no Apple interaction needed.
- **VAPID keypair** — Web Push self-identification, generated on first use
  and stored in a 0600 sidecar keyfile next to the DB (`<db>.vapid`) —
  deliberately *not* in the DB, so hibernation's S3 replica of `lchat.db`
  never carries a private key (docs/no-plaintext.md § 2; pre-keyfile
  instances migrate the legacy `config` rows into the file on first boot).
  Corollary: a hibernated instance restored onto a *different* box loses the
  file and re-mints on wake — see *Rotate* for what that costs. *Blast
  radius*: junk web pushes to that instance's subscribers. *Rotate*: delete
  the keyfile and restart to regenerate; existing push subscriptions break
  and members re-subscribe on next visit.

## Home

- **Session key** (`LCHAT_HOME_SESSION_KEY`) — HMAC ceremony proofs + sealed
  WebAuthn session params (both keys derived from it with distinct labels).
  Cannot open any vault. *Blast radius*: forge a 5-minute ceremony proof —
  i.e. the destructive-op gate (device revocation, blob delete, sign-in-method
  add/remove) for a user whose uid you already know; vault *content* stays
  ciphertext. *Rotate*: swap the env and restart; in-flight ceremonies fail
  once, harmless. Unset, home mints an ephemeral key per boot (self-hoster
  default).
- **Identity-anchor peppers** (`LCHAT_HOME_SIWA_PEPPER`,
  `LCHAT_HOME_EMAIL_PEPPER`, per-provider `LCHAT_HOME_<PROVIDER>_PEPPER`) —
  HMAC the provider's stable subject (or lowercased email) into the blind
  index that maps a sign-in anchor to an account; identity anchors can never
  decrypt. *Blast radius*: pepper plus a DB copy lets an attacker test
  whether a *known* email/Apple ID has an account (membership probing) —
  content stays sealed. *Rotate*: last-resort only — a new pepper orphans
  every existing anchor of that kind; users re-link via a remaining sign-in
  method.
- **SES sender key** (`AWS_*` on home when the email door is on; IAM user
  `ses-sender-production`, dev twin `ses-sender-dev`) — scoped to
  `ses:SendEmail` from `sign-in@elevenmessenger.com` only. *Blast radius*:
  send mail as the sign-in address (phishing paper). *Rotate*: standard IAM
  two-key rotation. Note it shares the `AWS_*` env with the S3 store below —
  an instance running both needs one IAM user carrying both scopes.
- **GitHub OAuth client secret** (`LCHAT_HOME_GITHUB_CLIENT_SECRET`) — the
  one sign-in door whose exchange home runs itself (github.go; the OIDC
  providers verify id_tokens and need no secret). *Blast radius*: initiate
  GitHub OAuth flows as the Eleven app — no stored user material to read.
  *Rotate*: regenerate at the GitHub OAuth app, swap the env, restart; the
  per-provider pepper (covered above) is untouched.
- **S3 backend credentials** (`AWS_*` when `LCHAT_HOME_STORE=s3`) — object
  access to the home bucket. *Blast radius*: read/overwrite vault ciphertext
  and WebAuthn public credentials; versioning keeps the last 5, so vandalism
  is recoverable. *Rotate*: standard IAM key rotation (mint second key, swap,
  delete first).

## Release & update chain

- **Server release signing key** — signs the release feed the whole fleet
  auto-updates from. **The highest-blast-radius secret in the system**: a
  forger ships code to every instance. Kept offline (1Password), used only at
  publish time via `LCHAT_RELEASE_KEY_FILE`. *Rotate*: instances verify
  against a pinned public key, so rotation is a two-step — ship an update
  (signed by the old key) that adds the new public key, then start signing
  with the new one. Treat loss-of-control as an incident, not a rotation.
- **Sparkle EdDSA key** (Mac app updates) — same shape and severity for the
  Mac app population; public key pinned in `ios/project.yml`. Same two-step
  rotation via a dual-trusted interim release.
- **App Store Connect API key** — TestFlight uploads + notarization.
  *Blast radius*: publish builds to the ASC account. *Rotate*: revoke + mint
  in ASC → Integrations.

## Push relay

- **APNs `.p8` signing key** — auth to Apple, not a decryption key; lives
  only on the relay. *Blast radius*: send pushes as the app (Apple sees the
  same ciphertext envelope regardless). *Rotate*: Apple allows two active
  keys — mint the new one in the developer portal, swap the relay env,
  restart, revoke the old.
- **Relay admin token** — mints/revokes per-instance relay tokens. *Rotate*:
  swap the env and restart the relay; existing instance tokens keep working.

## Bots & integrations

- **`ANTHROPIC_API_KEY`** — sidecar envs, plus (since the AI opt-in, #858)
  `/data/control.env`: controld's attach-bot step writes it into each fresh
  sidecar env it stages, so the provisioning daemon must hold it — bot code
  still never runs in the server process, and no *instance* env ever carries
  it. *Blast radius*: spend on the Anthropic account. *Rotate*: mint at the
  Anthropic console, swap sidecar envs + control.env, restart sidecars and
  `lchat-control` (note: a server release alone never restarts sidecars).
- **Bot identity keys** — the deliberate exception: real E2EE member keys,
  held in sidecar session state, able to decrypt exactly the threads the bot
  was added to. *Rotate*: there is no key rotation — remove the bot member
  (admin API) and re-provision a fresh identity via `add-bot`.
- **Connect broker: admin token + provider OAuth client secrets + per-instance
  broker tokens** — one client id/secret pair per OAuth-capable service in the
  integrations registry (DNSimple under its legacy env names; every other
  service — GitHub, Stripe, HubSpot, … — via `LCHAT_OAUTH_<ID>_CLIENT_ID` /
  `_CLIENT_SECRET`). The broker persists no OAuth user material, so the client
  secrets gate only the ability to *initiate* flows. *Rotate*: provider
  secrets at the provider dashboard + broker env swap; instance tokens via the
  broker admin API.

## Provisioning & DNS

- **DNS-01 token** (DNSimple, product account) — issues the wildcard cert
  and controls product DNS. *Blast radius*: DNS takeover of product domains =
  cert issuance for them; a top-tier secret. *Rotate*: mint a new account
  token at DNSimple, swap the router env, restart the router, revoke the old.
- **Cloud provisioner: admin token** (mints caller tokens), **caller tokens**
  (e.g. home's), and **controld's root-only control token**. *Blast radius*:
  create spaces up to quota/capacity caps (the caps are the real defense).
  *Rotate*: admin/control tokens by env swap + restart; caller tokens via
  the cloud admin API.

## Billing (Stripe)

- **Stripe secret key** (`LCHAT_STRIPE_SECRET_KEY`) — the **live** key the
  cloud provisioner uses for space-upgrade Checkout, the Billing Portal, and
  subscription webhook reconciliation. *Blast radius*: full API access to the
  Stripe account — customer emails and subscription state, refunds,
  cancellations. No message content (Stripe never sees the product), but the
  worst non-signing secret to lose. *Rotate*: roll the key in the Stripe
  dashboard (pick a grace window so the swap is zero-downtime), swap the cloud
  env, restart.
- **Stripe webhook signing secret** (`LCHAT_STRIPE_WEBHOOK_SECRET`) —
  authenticates Stripe's event posts to the cloud webhook endpoint. *Blast
  radius*: forge checkout/subscription events → mint or revoke space
  entitlements without payment; no access to the Stripe account itself.
  *Rotate*: roll the endpoint's signing secret in the Stripe dashboard, swap
  the cloud env, restart.
- **Stripe Connect platform key + webhook secret**
  (`LCHAT_STRIPE_CONNECT_KEY`, `LCHAT_STRIPE_CONNECT_WEBHOOK_SECRET`) —
  per-*instance* env powering paid access levels (member subscriptions via
  Stripe Connect). Deliberately tri-state: both unset → feature off; a partial
  config warns and stays off. *Blast radius*: the platform key can also act on
  connected accounts (sellers' Stripe accounts) within the platform's
  permissions; the webhook secret forges membership entitlements on that
  instance. *Rotate*: same shapes as the cloud pair above.
- **Enterprise Edition checkout key** (`LCHAT_STRIPE_ENTERPRISE_KEY`) — the
  cloud env's *separate* Stripe key for the elevenmessenger.com/enterprise/
  page (enterprise.go). Deliberately independent of
  `LCHAT_STRIPE_SECRET_KEY` with no fallback: it holds the **sandbox** key
  while real billing stays live, and the live flip is swapping this one
  value. *Blast radius*: whatever account the key belongs to — sandbox ≈
  none; if flipped live, same as the live key above. *Rotate*: roll in the
  matching Stripe mode's dashboard, swap the cloud env, restart.
- Kept alongside but **not secrets**: `LCHAT_STRIPE_PRICES` (the price book —
  price ids are public by the time Checkout renders) and
  `LCHAT_STRIPE_PORTAL_CONFIG` (a portal configuration id).

## AWS (from the #550 build-out)

- **`dev-agent` access key** — AdministratorAccess on the dev account, for
  IaC; in 1Password. *Rotate*: IAM two-key rotation. To be replaced by scoped
  roles once the OpenTofu skeleton defines them.
- **`dev-agent-james` access key** — James's own AdministratorAccess user on
  the same account, same purpose (IaC/tofu runs), so each operator has a
  revocable identity and CloudTrail attribution. Sealed in the secrets vault
  (`aws-dev-agent-james.env`, bundled with the DNSimple token so one file
  covers an `infra/` run). *Rotate*: IAM two-key rotation + re-seal.
  *Revoke*: delete the IAM user — independent of `dev-agent`.
- **`litestream-fleet` access key** — object-rw on the fleet-backup bucket
  only, lives in the router box's env file. *Blast radius*: read/delete
  backup ciphertext — versioning (which this user cannot touch) keeps 14 days
  of noncurrent versions, so deletion is recoverable. *Rotate*: IAM two-key
  rotation + env swap + `systemctl restart lchat-litestream`.
- **EC2 pool boxes carry no AWS keys at all** — bucket access rides instance
  roles; there is nothing to rotate or leak. This is the pattern all later
  boxes follow.