# OAuth Provider Update Runbook (March 19, 2026)

> **Retirement notice:** This procedure is historical. Do not apply its
> shared-development callback, Vercel, or Fly commands; use the current OAuth
> setup guide and shared-development retirement runbook.

## Goal

Replace the currently shared provider OAuth credentials with separate credentials for:

- local.
- dev.
- prod.

This runbook covers:

1. Google
2. OneDrive
3. Dropbox

## Operating Mode

Use Git Bash on Windows 11. Do not use WSL.

## Conventions

Projects and apps:

- Vercel dev project: `stratofusion-dev`.
- Vercel prod project: `stratofusion-prod`.
- Fly dev app: `stratofusion-rclone-dev`.
- Fly prod app: `stratofusion-rclone-prod`.

Environment URLs:

- local: `http://localhost:3000`.
- dev: `https://dev.stratofusion.io`.
- prod: `https://stratofusion.io`.

## Preparation

Before updating any provider, prepare the new values in Git Bash:

```bash
# Google
export GOOGLE_CLIENT_ID_LOCAL="<google-local-client-id>"
export GOOGLE_CLIENT_SECRET_LOCAL="<google-local-client-secret>"
export GOOGLE_REDIRECT_URI_LOCAL="http://localhost:3000/api/google"

export GOOGLE_CLIENT_ID_DEV="<google-dev-client-id>"
export GOOGLE_CLIENT_SECRET_DEV="<google-dev-client-secret>"
export GOOGLE_REDIRECT_URI_DEV="https://dev.stratofusion.io/api/google"

export GOOGLE_CLIENT_ID_PROD="<google-prod-client-id>"
export GOOGLE_CLIENT_SECRET_PROD="<google-prod-client-secret>"
export GOOGLE_REDIRECT_URI_PROD="https://stratofusion.io/api/google"

# OneDrive
export ONEDRIVE_CLIENT_ID_LOCAL="<onedrive-local-client-id>"
export ONEDRIVE_CLIENT_SECRET_LOCAL="<onedrive-local-client-secret>"
export ONEDRIVE_REDIRECT_URI_LOCAL="http://localhost:3000/api/onedrive"

export ONEDRIVE_CLIENT_ID_DEV="<onedrive-dev-client-id>"
export ONEDRIVE_CLIENT_SECRET_DEV="<onedrive-dev-client-secret>"
export ONEDRIVE_REDIRECT_URI_DEV="https://dev.stratofusion.io/api/onedrive"

export ONEDRIVE_CLIENT_ID_PROD="<onedrive-prod-client-id>"
export ONEDRIVE_CLIENT_SECRET_PROD="<onedrive-prod-client-secret>"
export ONEDRIVE_REDIRECT_URI_PROD="https://stratofusion.io/api/onedrive"

# Dropbox
export DROPBOX_CLIENT_ID_LOCAL="<dropbox-local-client-id>"
export DROPBOX_CLIENT_SECRET_LOCAL="<dropbox-local-client-secret>"
export DROPBOX_REDIRECT_URI_LOCAL="http://localhost:3000/api/dropbox"

export DROPBOX_CLIENT_ID_DEV="<dropbox-dev-client-id>"
export DROPBOX_CLIENT_SECRET_DEV="<dropbox-dev-client-secret>"
export DROPBOX_REDIRECT_URI_DEV="https://dev.stratofusion.io/api/dropbox"

export DROPBOX_CLIENT_ID_PROD="<dropbox-prod-client-id>"
export DROPBOX_CLIENT_SECRET_PROD="<dropbox-prod-client-secret>"
export DROPBOX_REDIRECT_URI_PROD="https://stratofusion.io/api/dropbox"
```

## Google

### Provider Console Checklist

Create three Google OAuth apps:

- local.
  - project name suggestion: `stratofusion-local`.
  - authorized redirect URI: `http://localhost:3000/api/google`.
- dev.
  - project name suggestion: `stratofusion-dev`.
  - authorized redirect URI: `https://dev.stratofusion.io/api/google`.
- prod.
  - project name suggestion: `stratofusion-prod`.
  - authorized redirect URI: `https://stratofusion.io/api/google`.

Enable:

- Google Drive API.

### Local Update

Set in local `.env.local`:

```bash
GOOGLE_CLIENT_ID="$GOOGLE_CLIENT_ID_LOCAL"
GOOGLE_CLIENT_SECRET="$GOOGLE_CLIENT_SECRET_LOCAL"
GOOGLE_REDIRECT_URI="$GOOGLE_REDIRECT_URI_LOCAL"
```

### Vercel Dev Update

```bash
vercel link --scope rikster1s-projects --project stratofusion-dev --yes
printf '%s' "$GOOGLE_CLIENT_ID_DEV" | vercel env add GOOGLE_CLIENT_ID production --force
printf '%s' "$GOOGLE_CLIENT_SECRET_DEV" | vercel env add GOOGLE_CLIENT_SECRET production --force --sensitive
printf '%s' "$GOOGLE_REDIRECT_URI_DEV" | vercel env add GOOGLE_REDIRECT_URI production --force
vercel deploy --prod --yes
```

### Vercel Prod Update

```bash
vercel link --scope rikster1s-projects --project stratofusion-prod --yes
printf '%s' "$GOOGLE_CLIENT_ID_PROD" | vercel env add GOOGLE_CLIENT_ID production --force
printf '%s' "$GOOGLE_CLIENT_SECRET_PROD" | vercel env add GOOGLE_CLIENT_SECRET production --force --sensitive
printf '%s' "$GOOGLE_REDIRECT_URI_PROD" | vercel env add GOOGLE_REDIRECT_URI production --force
vercel deploy --prod --yes
```

### Fly Update

Current note:

- The main app is the primary runtime source for provider credentials today.
- Fly updates are still recommended so the env surface stays consistent across environments.

```bash
flyctl secrets set -a stratofusion-rclone-dev \
  GOOGLE_CLIENT_ID="$GOOGLE_CLIENT_ID_DEV" \
  GOOGLE_CLIENT_SECRET="$GOOGLE_CLIENT_SECRET_DEV"

flyctl secrets set -a stratofusion-rclone-prod \
  GOOGLE_CLIENT_ID="$GOOGLE_CLIENT_ID_PROD" \
  GOOGLE_CLIENT_SECRET="$GOOGLE_CLIENT_SECRET_PROD"
```

### Google Verification

- local sign-in flow returns to `http://localhost:3000/api/google`.
- dev sign-in flow returns to `https://dev.stratofusion.io/api/google`.
- prod sign-in flow returns to `https://stratofusion.io/api/google`.

## OneDrive

### Provider Console Checklist

Create three Azure app registrations:

- local.
  - app name suggestion: `StratoFusion Local`.
  - redirect URI: `http://localhost:3000/api/onedrive`.
- dev.
  - app name suggestion: `StratoFusion Dev`.
  - redirect URI: `https://dev.stratofusion.io/api/onedrive`.
- prod.
  - app name suggestion: `StratoFusion Prod`.
  - redirect URI: `https://stratofusion.io/api/onedrive`.

Add Microsoft Graph permissions:

- `Files.Read.All`.
- `Files.ReadWrite.All`.
- `offline_access`.

If business/SharePoint flows must work, also ensure the required Sites permissions remain granted for the matching app registration.

### Local Update

Set in local `.env.local`:

```bash
ONEDRIVE_CLIENT_ID="$ONEDRIVE_CLIENT_ID_LOCAL"
ONEDRIVE_CLIENT_SECRET="$ONEDRIVE_CLIENT_SECRET_LOCAL"
ONEDRIVE_REDIRECT_URI="$ONEDRIVE_REDIRECT_URI_LOCAL"
```

### Vercel Dev Update

```bash
vercel link --scope rikster1s-projects --project stratofusion-dev --yes
printf '%s' "$ONEDRIVE_CLIENT_ID_DEV" | vercel env add ONEDRIVE_CLIENT_ID production --force
printf '%s' "$ONEDRIVE_CLIENT_SECRET_DEV" | vercel env add ONEDRIVE_CLIENT_SECRET production --force --sensitive
printf '%s' "$ONEDRIVE_REDIRECT_URI_DEV" | vercel env add ONEDRIVE_REDIRECT_URI production --force
vercel deploy --prod --yes
```

### Vercel Prod Update

```bash
vercel link --scope rikster1s-projects --project stratofusion-prod --yes
printf '%s' "$ONEDRIVE_CLIENT_ID_PROD" | vercel env add ONEDRIVE_CLIENT_ID production --force
printf '%s' "$ONEDRIVE_CLIENT_SECRET_PROD" | vercel env add ONEDRIVE_CLIENT_SECRET production --force --sensitive
printf '%s' "$ONEDRIVE_REDIRECT_URI_PROD" | vercel env add ONEDRIVE_REDIRECT_URI production --force
vercel deploy --prod --yes
```

### Fly Update

```bash
flyctl secrets set -a stratofusion-rclone-dev \
  ONEDRIVE_CLIENT_ID="$ONEDRIVE_CLIENT_ID_DEV" \
  ONEDRIVE_CLIENT_SECRET="$ONEDRIVE_CLIENT_SECRET_DEV"

flyctl secrets set -a stratofusion-rclone-prod \
  ONEDRIVE_CLIENT_ID="$ONEDRIVE_CLIENT_ID_PROD" \
  ONEDRIVE_CLIENT_SECRET="$ONEDRIVE_CLIENT_SECRET_PROD"
```

### OneDrive Verification

- local sign-in flow returns to `http://localhost:3000/api/onedrive`.
- dev sign-in flow returns to `https://dev.stratofusion.io/api/onedrive`.
- prod sign-in flow returns to `https://stratofusion.io/api/onedrive`.

## Dropbox

### Provider Console Checklist

Create three Dropbox apps:

- local.
  - app name suggestion: `StratoFusion Local`.
  - redirect URI: `http://localhost:3000/api/dropbox`.
- dev.
  - app name suggestion: `StratoFusion Dev`.
  - redirect URI: `https://dev.stratofusion.io/api/dropbox`.
- prod.
  - app name suggestion: `StratoFusion Prod`.
  - redirect URI: `https://stratofusion.io/api/dropbox`.

Add required scopes:

- `files.metadata.read`.
- `files.content.read`.
- `files.content.write`.

If business/team folder access is needed, keep the business/team scopes aligned with the current app behavior.

### Local Update

Set in local `.env.local`:

```bash
DROPBOX_CLIENT_ID="$DROPBOX_CLIENT_ID_LOCAL"
DROPBOX_CLIENT_SECRET="$DROPBOX_CLIENT_SECRET_LOCAL"
DROPBOX_REDIRECT_URI="$DROPBOX_REDIRECT_URI_LOCAL"
```

### Vercel Dev Update

```bash
vercel link --scope rikster1s-projects --project stratofusion-dev --yes
printf '%s' "$DROPBOX_CLIENT_ID_DEV" | vercel env add DROPBOX_CLIENT_ID production --force
printf '%s' "$DROPBOX_CLIENT_SECRET_DEV" | vercel env add DROPBOX_CLIENT_SECRET production --force --sensitive
printf '%s' "$DROPBOX_REDIRECT_URI_DEV" | vercel env add DROPBOX_REDIRECT_URI production --force
vercel deploy --prod --yes
```

### Vercel Prod Update

```bash
vercel link --scope rikster1s-projects --project stratofusion-prod --yes
printf '%s' "$DROPBOX_CLIENT_ID_PROD" | vercel env add DROPBOX_CLIENT_ID production --force
printf '%s' "$DROPBOX_CLIENT_SECRET_PROD" | vercel env add DROPBOX_CLIENT_SECRET production --force --sensitive
printf '%s' "$DROPBOX_REDIRECT_URI_PROD" | vercel env add DROPBOX_REDIRECT_URI production --force
vercel deploy --prod --yes
```

### Fly Update

```bash
flyctl secrets set -a stratofusion-rclone-dev \
  DROPBOX_CLIENT_ID="$DROPBOX_CLIENT_ID_DEV" \
  DROPBOX_CLIENT_SECRET="$DROPBOX_CLIENT_SECRET_DEV"

flyctl secrets set -a stratofusion-rclone-prod \
  DROPBOX_CLIENT_ID="$DROPBOX_CLIENT_ID_PROD" \
  DROPBOX_CLIENT_SECRET="$DROPBOX_CLIENT_SECRET_PROD"
```

### Dropbox Verification

- local sign-in flow returns to `http://localhost:3000/api/dropbox`.
- dev sign-in flow returns to `https://dev.stratofusion.io/api/dropbox`.
- prod sign-in flow returns to `https://stratofusion.io/api/dropbox`.

## Final Verification Sequence

After all three providers are updated:

```bash
# Dev project
vercel link --scope rikster1s-projects --project stratofusion-dev --yes
vercel deploy --prod --yes

# Prod project
vercel link --scope rikster1s-projects --project stratofusion-prod --yes
vercel deploy --prod --yes

# Fly parity
cd fly-rclone
./deploy.sh --env dev
./deploy.sh --env prod
```

Then verify:

- Google auth works in local, dev, and prod.
- OneDrive auth works in local, dev, and prod.
- Dropbox auth works in local, dev, and prod.
- Existing shared credentials are no longer present in Vercel dev/prod envs.
- Existing shared credentials are no longer present in Fly dev/prod secrets.