​

GitHub Secrets & Token Management

​

CloudFlare Token Confusion: CF_API_TOKEN vs. CLOUDFLARE_API_TOKEN

​

Current State

​

Why We Have Two

1. Different CloudFlare tools expect different env var names
2. Wrangler uses CF_API_TOKEN natively
3. Older CloudFlare documentation referenced CLOUDFLARE_API_TOKEN
4. Both were created at different times without consolidation

​

Action Required

1. ✅ In .github/workflows/deploy.yml, verify it uses:

env:
  CF_API_TOKEN: ${{ secrets.CF_API_TOKEN }}

2. ❌ Never use:

env:
  CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

3. In wrangler.jsonc, do not set api_token — let it read from CF_API_TOKEN env var

​

Complete GitHub Secrets Inventory

​

Required for Factory Core (monorepo)

​

Required for Each App Repository

​

Required for Factory Video Rendering Pipeline

​

Required for Prime Self Smoke Validation

​

How to Set GitHub Secrets

​

For Factory Core (monorepo)

1. Navigate to: https://github.com/adrper79-dot/Factory/settings/secrets/actions
2. Click “New repository secret”
3. Add each secret from the inventory above
4. Verify in workflows: Go to Actions → select any workflow → check “Secrets” are populated

​

For Each App (original 6 apps + any standalone apps)

1. Navigate to: https://github.com/adrper79-dot/{app}/settings/secrets/actions
2. Click “New repository secret”
3. Add secrets from “Required for Each App Repository” table
4. Commit the app’s wrangler.jsonc to reference via interpolation

​

Setting Secrets in wrangler.jsonc

{
  "env": {
    "production": {
      "vars": {
        "SENTRY_DSN": "https://xxx@xxx.ingest.sentry.io/xxx",
        "POSTHOG_KEY": "phc_xxx..."
      }
    }
  }
}

{
  "env": {
    "production": {
      "vars": {
        "DATABASE_URL": "postgres://user:password@..."  // NO!
      }
    }
  }
}

env:
  SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
  POSTHOG_KEY: ${{ secrets.POSTHOG_KEY }}

​

Wrangler Secret vs. GitHub Secret

# Only set in Worker, not in GitHub public logs
openssl rand -base64 32 | wrangler secret put JWT_SECRET --env production --name {app}

​

Rotation Schedule

​

Troubleshooting

​

Error: “403 Forbidden: PUT https://npm.pkg.github.com”

1. Generate new GitHub PAT: https://github.com/settings/tokens?type=beta
2. Scopes needed: read:packages only
3. Update Secret: https://github.com/adrper79-dot/{repo}/settings/secrets/actions
4. Re-run workflow

​

Error: “Unauthorized: CF_API_TOKEN invalid”

1. Check .github/workflows/deploy.yml for correct env var name
2. Verify GitHub Secrets page lists CF_API_TOKEN (not CLOUDFLARE_API_TOKEN)
3. Test locally: CF_API_TOKEN=xxx wrangler deploy

​

Error: “Failed to connect to database: ECONNREFUSED”

1. In Neon console: Project → Connection string → Copy fresh string
2. Update GitHub Secrets: NEON_URL or DATABASE_URL (match app’s naming convention)
3. Redeploy: wrangler deploy --env production

​

Error: “Sentry 401: Invalid DSN”

1. In Sentry: Settings → Projects → → Client Keys (DSN)
2. Copy exact URL
3. Update GitHub Secrets: SENTRY_DSN
4. Redeploy

​

Error: “render-video workflow secret not found”

1. Compare the repository secrets against the “Required for Factory Video Rendering Pipeline” table above.
2. Add the missing secret in Settings → Secrets and variables → Actions.
3. Re-run the failed workflow and verify the schedule-worker callback succeeds.

​

Audit Checklist

• All Factory app repos have CF_API_TOKEN set (original 6 + xpelevator + xico-city + any new standalone apps)
• No repo has CLOUDFLARE_API_TOKEN set without also having CF_API_TOKEN (both are needed for compatibility)
• Each app has SENTRY_DSN and POSTHOG_KEY set as Wrangler secrets (not GitHub Secrets)
• NODE_AUTH_TOKEN / GH_PAT is fresh (< 90 days old)
• Wrangler secrets are up to date (run wrangler secret list --name {app} per app)
• No hardcoded passwords in wrangler.jsonc or source code
• HYPERDRIVE_* secrets exist in Factory repo for all apps with standalone workflows
• Rate limiter ID registry in add-new-app.md is up to date

​

Related Runbooks

• Deployment Runbook — How to deploy with these secrets
• Secret Rotation Runbook — How to rotate specific secrets
• Add New App Runbook — Per-app secret naming conventions when onboarding a new standalone app