Skip to main content

Doc-Bot Credentials & Rotation

The doc-update bot authenticates as the qubital-doc-bot GitHub App for all cross-repo operations. This page records the App identity and explains how to rotate credentials. No secret values are stored here.

App identity​

FieldValue
App namequbital-doc-bot
App ID3921834
OwnerStartingQuoTechDivision
Installed onqubital-backend, docs repo

To locate the App: GitHub → Settings → Developer settings → GitHub Apps → qubital-doc-bot.

Stored credentials​

NameTypeStored atContains
DOC_BOT_APP_IDVariablequbital-backend repo (temporary — migrate to org level when org is created)Numeric App ID
DOC_BOT_APP_PRIVATE_KEYSecretqubital-backend repo (temporary — migrate to org level when org is created)PEM-encoded private key
DOC_BOT_ANTHROPIC_API_KEYSecretqubital-backend repo (temporary — migrate to org level when org is created)Anthropic API key for Claude calls

Rotate the private key​

  1. Go to GitHub → Settings → Developer settings → GitHub Apps → qubital-doc-bot → General.
  2. Scroll to Private keys → Generate a private key. A .pem file downloads automatically.
  3. Update DOC_BOT_APP_PRIVATE_KEY in the repo (or org) secrets with the contents of the new .pem file.
  4. Delete the old private key from the App settings page.
  5. Delete the local .pem file — do not commit it.

The old key remains valid until deleted in step 4. Generate the new key first, update the secret, then delete the old key — this order avoids downtime.

Rotate the Anthropic API key​

  1. Generate a new key at console.anthropic.com → API Keys.
  2. Update DOC_BOT_ANTHROPIC_API_KEY in the repo (or org) secrets.
  3. Revoke the old key in the Anthropic console.

Migrate secrets to org level​

These credentials are stored at repo level because no GitHub Organization exists yet. When the team moves to a GitHub Organization:

  1. Add DOC_BOT_APP_ID, DOC_BOT_APP_PRIVATE_KEY, and DOC_BOT_ANTHROPIC_API_KEY as org-level secrets/variables.
  2. Remove the repo-level copies from qubital-backend.
  3. No workflow changes are required — the variable and secret names stay the same.