Parent: #1970
Goal
Turn the merged provisioning API authentication contract into an operable multi-principal production control plane with auditable issuance, rotation, revocation, and least-privilege policy.
Current limitation
Bearer token definitions are static JSON in WORDPRESS_API_TOKENS, and production provisioning lacks the required API token, administrator-claim, and site-fleet configuration. The request contract works locally but is not an operable production credential lifecycle.
Scope
- generic issuer-backed principal identity or service-account API keys stored only as digests
- scoped grants for artifact staging, site create/read/import, operation read, renewal, and deletion
- per-principal quotas, expiration, revocation, rotation overlap, and optional site restrictions
- administrator-claim and persistent site credential root rotation with generation/version evidence
- redacted audit events for authentication, authorization, allocation, claims, and revocation
- Homeboy-managed secret/binding preflight without exposing plaintext values
Acceptance criteria
- A principal can be issued, rotated, and revoked without Worker source changes or redeployment where the Cloudflare binding model permits.
- Revocation is effective for new API calls while previously committed operations follow explicit policy.
- Scope, quota, expiry, site ownership, and cross-principal denial are deterministic.
- Secret rotation preserves or intentionally invalidates administrator claims and credentials according to versioned policy.
- Logs and deployment evidence contain no bearer, claim, password, or derived secret values.
- Local and isolated remote gates cover malformed tokens, replay, rotation overlap, revocation races, and least privilege.
- Production mutation remains a separately authorized operator step.
AI assistance
OpenAI GPT-5.6 Sol via OpenCode reviewed the static token and claim configuration and drafted this production credential lifecycle with Chris Huber.
Parent: #1970
Goal
Turn the merged provisioning API authentication contract into an operable multi-principal production control plane with auditable issuance, rotation, revocation, and least-privilege policy.
Current limitation
Bearer token definitions are static JSON in
WORDPRESS_API_TOKENS, and production provisioning lacks the required API token, administrator-claim, and site-fleet configuration. The request contract works locally but is not an operable production credential lifecycle.Scope
Acceptance criteria
AI assistance
OpenAI GPT-5.6 Sol via OpenCode reviewed the static token and claim configuration and drafted this production credential lifecycle with Chris Huber.