Skip to content
My Marketing Pro

Secret Rotation Checklist

Secret Rotation Checklist

Section titled “Secret Rotation Checklist”

Start Time: 2026-01-21 Status: IN PROGRESS - Most critical services restored

Progress Summary

Section titled “Progress Summary”

✅ COMPLETED (Services Restored)

Section titled “✅ COMPLETED (Services Restored)”
  • ✅ AWS RDS Database Passwords - Database back online
  • ✅ Stripe Live API Key - Payments back online
  • ✅ Google OAuth (4 clients) - Auth back online
  • ✅ Google Maps API Keys - Maps back online

⏳ PENDING (Non-critical)

Section titled “⏳ PENDING (Non-critical)”
  • ⏸️ Twilio API Key - SMS/Voice currently unavailable
  • ⏸️ WATT Data API Key - Low priority

STEP 1: Rotate Critical Keys ✅ COMPLETED

Section titled “STEP 1: Rotate Critical Keys ✅ COMPLETED”

✅ AWS RDS Database Passwords - COMPLETED

Section titled “✅ AWS RDS Database Passwords - COMPLETED”

Status: Successfully rotated and switched to dedicated application users

  • Reset RDS master password in AWS Console
  • Updated to use dedicated users instead of admin:
    • mmp_app_user for main application
    • emailblasteruser for email blaster
    • mixpostuser for mixpost
  • Updated 50+ PHP files with new credentials

Security Improvement: No longer using admin superuser for application connections!

✅ Stripe API Keys - COMPLETED

Section titled “✅ Stripe API Keys - COMPLETED”

Status: Live key rotated successfully

  • Rolled Live Secret Key in Stripe Dashboard
  • New key: sk_live_51QuhaNCt3pv3rS9Azi0X... (stored securely)
  • Updated 4 files:
    • includes/config.php
    • stripe-config.php
    • process-single-payment.php
    • delivery/data-api.php
  • Publishable key unchanged (safe to expose publicly)
  • Test key skipped (only in commented code)

⏸️ Twilio API Key - PENDING

Section titled “⏸️ Twilio API Key - PENDING”

Status: Waiting to create new key before deploying to production

To complete this:

  1. Go to: https://console.twilio.com/us1/develop/api-keys
  2. Create new API Key → Standard
  3. Copy new Key SID (starts with SK...)
  4. Copy new Key Secret (shows only once!)
  5. Update includes/config.php lines 46-48

Old Key SID (compromised): SKb2bf*************************** (REDACTED) Old Key Secret (compromised): USbn************************* (REDACTED)

Account SID (no rotation needed): AC89************************ (REDACTED for security)

✅ Google OAuth Client Secrets - COMPLETED

Section titled “✅ Google OAuth Client Secrets - COMPLETED”

Status: All 4 OAuth clients recreated successfully

✅ Main OAuth Client (Login)

Section titled “✅ Main OAuth Client (Login)”
  • Created new OAuth client in Google Cloud Console
  • Client ID: 713572660880-emm0qr22ft41o200199qi46gu969jvqb.apps.googleusercontent.com
  • Updated 2 files: config.php, app-auth.php
  • Configured redirect URIs

✅ Calendar/Gmail OAuth

Section titled “✅ Calendar/Gmail OAuth”
  • Created new OAuth client
  • Client ID: 713572660880-a1bi13qirstm8n5skrbb59i21q3qn68p.apps.googleusercontent.com
  • Updated 9 files (all calendar/gmail integrations)

✅ Gmail/Onboarding OAuth

Section titled “✅ Gmail/Onboarding OAuth”
  • Created new OAuth client
  • Client ID: 713572660880-mkrdgrd4mhr25jt40pbs3t9adpc8780n.apps.googleusercontent.com
  • Updated 3 files

✅ Refresh Token OAuth

Section titled “✅ Refresh Token OAuth”
  • Reused Calendar/Gmail OAuth client (same settings)
  • Updated 2 files

✅ Google Maps API Keys - COMPLETED

Section titled “✅ Google Maps API Keys - COMPLETED”

Status: All 5 keys consolidated into single primary key

  • Created new primary API key: AIzaSyBbJ74mwHBWJep8ZjIz8cKjGV0gmLWjUrA
  • Configured HTTP referrer restrictions
  • Replaced old primary key in 26 files
  • Replaced 4 secondary keys in 13 files
  • Total: 39 files now using single consolidated key

Decision: Consolidated all keys since they had identical settings (simpler management)

⏸️ WATT Data API Key - PENDING (Low Priority)

Section titled “⏸️ WATT Data API Key - PENDING (Low Priority)”

Status: Requires contacting WATT support

To complete this:

  1. Contact WATT support
  2. Request new API key due to security incident
  3. Update includes/config.php line 32

Old Key (compromised): bXRfMmZkNzUwMDUwZmUxOGUwZjNhZjMwYzg4YTE0OTAyODc...

STEP 2: Deployment Status

Section titled “STEP 2: Deployment Status”

Files Modified

Section titled “Files Modified”
  • Database connections: 50+ files
  • Stripe: 4 files
  • Google OAuth: 15 files
  • Google Maps: 39 files
  • Total: ~100+ files updated

Ready for Production Deployment

Section titled “Ready for Production Deployment”

All critical services (Database, Stripe, Google OAuth, Maps) have been rotated and are ready for deployment.

Remaining before full restoration:

  • Twilio API Key (SMS/Voice will remain offline until rotated)
  • WATT API Key (non-critical, can be done later)

STEP 3: Testing After Deployment

Section titled “STEP 3: Testing After Deployment”

Once deployed to production, test these services:

  • Database connection works
  • User login works (Google OAuth)
  • Google Calendar integration works
  • Gmail integration works
  • Maps load correctly on campaign pages
  • Stripe payments process successfully
  • SMS sending works (after Twilio rotation)
  • Voice calls work (after Twilio rotation)

Security Improvements Implemented

Section titled “Security Improvements Implemented”
  1. Dedicated Database Users: Switched from admin superuser to dedicated application users (mmp_app_user, emailblasteruser, mixpostuser)
  2. Consolidated API Keys: Reduced Google Maps keys from 5 to 1 for easier management
  3. Automated Replacements: Used scripts to ensure all occurrences were updated
  4. Documentation: Created secure credentials file outside git repository

Important Notes

Section titled “Important Notes”

⚠️ NEVER commit these credentials to git

✅ Store securely in:

  • Password manager (1Password, LastPass, etc.)
  • Encrypted cloud storage
  • Secure credentials file outside git repo

❌ NEVER share via:

  • Email
  • Slack/Discord
  • Plain text in cloud drives
  • Any public location

Next Steps

Section titled “Next Steps”
  1. Deploy to Production - All critical services ready
  2. Rotate Twilio - Create new API key to restore SMS/Voice
  3. Test All Services - Verify everything works
  4. Rotate WATT - Low priority, can be done later
  5. Delete Old Keys - After confirming everything works
  6. Update Password Manager - Store all new credentials securely

Timeline

Section titled “Timeline”
  • Start: 2026-01-21 morning
  • Database Rotated: 2026-01-21 afternoon
  • Stripe Rotated: 2026-01-21 afternoon
  • Google OAuth: 2026-01-21 afternoon
  • Google Maps: 2026-01-21 afternoon
  • Ready for Deploy: 2026-01-21 evening
  • Pending: Twilio, WATT

Contact Information

Section titled “Contact Information”

If you need help with any service rotation: