Rotating secrets

• API key for our apps to talk to our API
• API key for our apps to talk to document download API

API key for our apps to talk to our API

For our applications to talk our API they must use one of the API keys found in API_INTERNAL_SECRETS in credentials/<env>/paas/environment_variables. If you want to rotate these keys then you should:

1. Add the new secret to API_INTERNAL_SECRETS in credentials/<env>/paas/environment_variables
2. Deploy the API so it now allows apps to auth with the new secret
3. Change ADMIN_CLIENT_SECRET in credentials/<env>/paas/environment_variables and credentials/<env>/document-download/paas-environment to be the new secret
4. Deploy document-download-frontend and the admin app
5. Remove the old secret from API_INTERNAL_SECRETS in credentials/<env>/paas/environment_variables
6. Deploy the API to preview and then run functional tests for all the other apps (antivirus, document download etc) to check they can still talk to the API. If so, you can then continue to deploy the API to production

API key for our apps to talk to document download API

For our applications to talk to the document download API they must use one of the API keys found in AUTH_TOKENS in `credentials//document-download/paas-environment. If you want to rotate these keys then you should:

1. Add the new secret to AUTH_TOKENS in credentials/<env>/document-download/paas-environment using a : separated list, for example secret1:secret2
2. Deploy the document download API so it now allows apps to auth with the new secret
3. Change DOCUMENT_DOWNLOAD_API_KEY in credentials/<env>/paas/environment_variables to be the new secret
4. Deploy the API
5. Remove the old secret from AUTH_TOKENS in credentials/<env>/document-download/paas-environment
6. Deploy the document download API to preview and then run functional tests for all the other apps (admin, api, document download, antivirus) to check they can still talk to the document download API. If so, you can then continue to deploy the API to production