create-ailk 0.22.0 → 0.23.0

package/templates/apps/api/.env.example

@@ -98,6 +98,33 @@ STRIPE_WEBHOOK_SECRET=whsec_xxx
 # unreadable: each workspace must then reconnect. Never log or share it.
 # SCHEDULING_CREDENTIAL_KEY=
 #
+# An Organization's Stripe connection (#8907) — the AES-256-GCM key each
+# Organization's restricted Stripe key and webhook signing secret are
+# encrypted under. The same shape rule: exactly 32 random bytes in canonical
+# standard base64 (`openssl rand -base64 32`), and never the same bytes as
+# SCHEDULING_CREDENTIAL_KEY. Any other value stops the API at startup. Unset
+# means a connection can be read, reset and removed, but connect, go-live and
+# the webhook secret answer 503 credential_key_not_configured.
+#
+# ONE KEY PER DATABASE. A deployment whose database holds live connections
+# sets this key on production only; a preview or development deployment that
+# shares that database must never be given it. A preview with its own
+# database takes its own key. (A build that is not production also refuses to
+# read or change a live connection.)
+#
+# ROTATION. Set STRIPE_CONNECTION_KEY_PREVIOUS to the old key and
+# STRIPE_CONNECTION_KEY to a new one, redeploy, run
+# `node dist/bin/stripe-connections-rekey.js` (dev:
+# `pnpm --filter @working-theory/api stripe-connections:rekey`) with the
+# production environment (VERCEL_ENV=production, or NODE_ENV=production off
+# Vercel) — anywhere else it prints `not_production` and touches nothing —
+# and unset _PREVIOUS once it prints `remaining=0`. A row it counts `unreadable`
+# decrypts under neither key and stays so after _PREVIOUS is unset: its owner
+# reconnects or disconnects. _PREVIOUS without a current key, or equal to it,
+# stops the API.
+# STRIPE_CONNECTION_KEY=
+# STRIPE_CONNECTION_KEY_PREVIOUS=
+#
 # The booking webhook receiver (#6085) — a SEPARATE credential from the
 # three above: it verifies POST /v1/webhooks/calcom's x-cal-signature-256
 # header, it does not call the provider. Unset makes the receiver answer 503