Secrets & Environment

Two layers of secrets in databayt:

The Gist holds ~25 keys across sections (required, databases, ai, auth, services, cloudinary, imagekit, telegram, optional). The template lives at .claude/scripts/secrets-template.json. The Gist is hand-curated — admins fork the template, paste real values, and share the Gist ID out-of-band (Signal, Notes, 1Password). The script reads the Gist anonymously, so it must be secret (not private).

Cross-cutting secrets (Gist → ~/.claude/.env)

Pull from the Gist:

Copybash ~/kun/.claude/scripts/secrets.sh <GIST_ID>

The script writes ~/.claude/.env with chmod 600 and appends an auto-export line to ~/.zshrc / ~/.bashrc. Re-run to refresh whenever a key rotates.

Per-product app env (Vercel → ~/<repo>/.env)

Each product on Vercel (kun, hogwarts, codebase, souq, mkan, shifa, marketing) has its env vars in the Vercel team databayt. The onboarding installer pulls them automatically during Phase 6 via the vercel-pull.sh helper:

Copy# What runs per cloned repo
cd ~/hogwarts
vercel link --yes --project=hogwarts --scope=databayt
vercel env pull .env --environment=development

Re-pull anytime to refresh:

Copybash ~/kun/.claude/scripts/vercel-pull.sh

If you weren't logged in during install, run vercel login (OAuth, browser) and re-run the script.

Gotchas

Trailing newline (real incident). Vercel dashboard paste adds invisible \n to values. A GITHUB_PERSONAL_ACCESS_TOKEN with \n makes Authorization: Bearer <token>\n throw invalid header value — broke kun's report-an-issue form (PR #97). Always .trim() env reads in code. If you must set values via CLI, do it cleanly:

Copy# Right — printf strips trailing newline
printf '%s' "$VALUE" | vercel env add NAME production
 
# Wrong — chaining stores an empty value
vercel env rm NAME && vercel env add NAME

.env, not .env.local. databayt convention is a single central .env per repo. Don't create .env.local, .env.development, etc. — see ~/.claude/CLAUDE.md.

GITHUB_PERSONAL_ACCESS_TOKEN, not GITHUB_TOKEN. Canonical var name across all databayt repos. Fine-grained PAT (github_pat_...). Same token is reused across ~/.claude/mcp.json and per-repo .env files.

Troubleshooting

"Token may lack read:org scope" during install

Copygh auth refresh -h github.com -s read:org -w

Vercel env pull skipped during install

You weren't logged in. Run:

Copyvercel login
bash ~/kun/.claude/scripts/vercel-pull.sh

Secrets section missing in my Gist

The Gist is hand-curated. Ask the admin to add the section to .claude/scripts/secrets-template.json and update the Gist.

Anthropic auth fails

Copyecho $ANTHROPIC_API_KEY   # should print sk-ant-...
claude doctor             # full surface check

Requesting new secrets

1. Open an issue in databayt/kun describing what you need
2. Admin adds the key to the Gist
3. Re-run secrets.sh <GIST_ID> to refresh ~/.claude/.env

For Vercel-managed app env vars, ask the admin to add the var on the Vercel project at vercel.com/teams/databayt/<project>/settings/environment-variables, then re-run bash ~/kun/.claude/scripts/vercel-pull.sh.