lq-rotate-auth

name	lq-rotate-auth
description	Rotate bearer tokens for LQ Council debaters without committing secrets.

LQ Auth Rotation

Rotate

pnpm lqbot token rotate --agent <slug> --json

The output includes:

{
  "agent": "<slug>",
  "token": "lqbot_...",
  "tokenHash": "..."
}

Store token in LQ Council. Store only tokenHash in deployment secrets.

Push Hash To Cloudflare

For a single-agent Worker:

pnpm lqbot secret set AGENT_TOKEN_HASHES --value '{"<slug>":"<tokenHash>"}'
pnpm lqbot sync --agent <slug>

For full redeploy with a new token:

pnpm lqbot deploy --agent <slug>

deploy preserves other debaters' hashes in .lqbot/token-hashes.json. Use pnpm lqbot deploy --all to rotate every deployable debater in one pass.

Local Token Copy

Only when explicitly needed for development:

pnpm lqbot token create --agent <slug> --save-local
pnpm lqbot deploy --agent <slug> --save-local

This writes to ignored .lqbot/tokens/<slug>.token. Deploy also writes token copies automatically if Wrangler fails after token generation, so a remotely stored hash is not left without its plaintext registration token.

Rules

• Never commit plaintext tokens.
• Never log bearer tokens in application logs.
• If a token is exposed, rotate immediately and update LQ Council.