Retirement notice: This is point-in-time evidence. Shared-development
callbacks, project commands, and client mappings are retained only to support
approval-gated external cleanup.
This runbook applies the March 19 procedure specifically to Google OAuth and locks each environment to its dedicated Google OAuth 2.0 client.
Audit Snapshot
Verified in the local workspace on April 7, 2026:
.env.local already points at the dedicated stratofusion-local Google client and the correct local redirect URI.
Untracked local snapshot files .env.development, .env.production, .env.vercel.development, and .env.vercel.production were corrected so they no longer reference the deleted shared Google client.
Active Vercel team slug: rikster1s-projects.
Vercel dev project: stratofusion-dev (prj_IyHLvDsGAbyCe90tlIyPsykjUBBy).
Use the Google Cloud Console OAuth 2.0 Client IDs screen and verify each client separately.
Shared checks for all three clients:
Open the correct OAuth 2.0 Client ID by name and client ID.
Confirm application type is Web application.
Confirm the client belongs to the intended StratoFusion environment only.
Confirm Google Drive API is enabled in the project that owns the client.
Confirm the deleted shared StratoFusion client is not referenced anywhere in Vercel, local env files, or operator notes.
Copy the client secret for the matching client into the Git Bash exports above.
Client-specific checks:
stratofusion-prod.
Client ID must be 856037110351-3k9mtp3tg364lf8qlesdl37t6t4lqf0e.apps.googleusercontent.com.
Authorized redirect URIs must include https://stratofusion.io/api/google.
Remove any dev or localhost redirect URI from this client.
stratofusion-dev.
Client ID must be 856037110351-ho0oim9es4d9652kdt95ij4r19umdq32.apps.googleusercontent.com.
Authorized redirect URIs must include https://dev.stratofusion.io/api/google.
Remove any prod or localhost redirect URI from this client.
stratofusion-local.
Client ID must be 856037110351-7cjkts1e8ut7pp03a5nbqaobhot8jnuf.apps.googleusercontent.com.
Authorized redirect URIs must include http://localhost:3000/api/google.
Remove any prod or dev redirect URI from this client.
Do not edit or reuse:
StratoFusion.
This shared client was deleted during the April 7, 2026 cleanup.
Unused-client warnings and lifecycle policy
Google may warn project owners before deleting an OAuth client that it considers
unused. Treat the client ID in the warning as the source of truth; the display
name alone is not enough to identify an environment.
There is no StratoFusion code or Google Cloud Console setting that permanently
marks an idle client as "keep forever." Resolve every warning by choosing one of
these outcomes:
The client is obsolete: verify that its full client ID is absent from
Vercel, local environment files, Clerk custom Google credentials, operator
secrets, and the runtime OAuth URL. Delete the client in Google Cloud Console.
The client serves production or dev: verify the environment mapping below,
then complete a real end-to-end authorization in that environment before the
deadline in Google's notice. A successful token refresh alone must not be
assumed to count as client use. Re-run the runtime URL and callback checks in
this runbook.
The client is local-only: use it for a real local authorization when local
development is active. If local Google OAuth is intentionally dormant, allow
the client to be retired and create a new localhost-only client when it is
next needed; do not manufacture background consent traffic solely to preserve
an unused credential.
Never keep a client alive by putting production, dev, and localhost callbacks on
one client. Environment isolation remains more important than preserving an
inactive client ID.
Quarterly ownership review
Run this review every quarter and whenever Google sends an unused-client notice:
Export the OAuth client list from the owning Google Cloud project and record
each client ID suffix, display name, owner, environment, and expected callback
in the private operator inventory. Do not put client secrets in the inventory
or this repository.
Compare each active client with the three approved IDs in this runbook and
with the corresponding Vercel and Clerk configuration.
Run the deployed runtime OAuth URL checks for dev and production. For each
environment still in active use, perform a real browser authorization using a
designated test account and record the date and result in the private
inventory.
Delete clients that have no owner or runtime consumer after the absence checks
above. Rotate credentials immediately if a warning names an unknown client or
if its secret may have been exposed.
This policy makes the durable state explicit: production and active dev clients
are exercised by real release smoke tests, local clients are disposable, and
orphaned clients are deleted instead of being kept alive indefinitely.
Vercel Update Commands
Important:
Use production as the target in both Vercel projects. In this repo, each Vercel project represents its own deployed environment, so stratofusion-dev still needs its Google vars set in that project's production target.
Secrets must be added with --sensitive.
Update stratofusion-dev
vercel link --scope "$VERCEL_SCOPE" --project stratofusion-dev --yes
printf'%s'"$GOOGLE_CLIENT_ID_DEV"| vercel envadd GOOGLE_CLIENT_ID production --force --scope "$VERCEL_SCOPE"printf'%s'"$GOOGLE_CLIENT_SECRET_DEV"| vercel envadd GOOGLE_CLIENT_SECRET production --force --sensitive --scope "$VERCEL_SCOPE"printf'%s'"$GOOGLE_REDIRECT_URI_DEV"| vercel envadd GOOGLE_REDIRECT_URI production --force --scope "$VERCEL_SCOPE"vercel deploy --prod --yes --scope "$VERCEL_SCOPE"
Update stratofusion-prod
vercel link --scope "$VERCEL_SCOPE" --project stratofusion-prod --yes
printf'%s'"$GOOGLE_CLIENT_ID_PROD"| vercel envadd GOOGLE_CLIENT_ID production --force --scope "$VERCEL_SCOPE"printf'%s'"$GOOGLE_CLIENT_SECRET_PROD"| vercel envadd GOOGLE_CLIENT_SECRET production --force --sensitive --scope "$VERCEL_SCOPE"printf'%s'"$GOOGLE_REDIRECT_URI_PROD"| vercel envadd GOOGLE_REDIRECT_URI production --force --scope "$VERCEL_SCOPE"vercel deploy --prod --yes --scope "$VERCEL_SCOPE"
Local .env.local Update
This updates only the Google keys in .env.local and leaves other values untouched.
node - <<'EOF'
const fs = require('fs');
const path = '.env.local';
const updates = {
GOOGLE_CLIENT_ID: process.env.GOOGLE_CLIENT_ID_LOCAL,
GOOGLE_CLIENT_SECRET: process.env.GOOGLE_CLIENT_SECRET_LOCAL,
GOOGLE_REDIRECT_URI: process.env.GOOGLE_REDIRECT_URI_LOCAL,
};
let text = fs.existsSync(path) ? fs.readFileSync(path, 'utf8') : '';
for (const [key, value] of Object.entries(updates)) {
if (!value) {
throw new Error(`Missing required value for ${key}`);
}
const line = `${key}=${value}`;
const pattern = new RegExp(`^${key}=.*$`, 'm');
if (pattern.test(text)) {
text = text.replace(pattern, line);
} else {
if (text.length > 0 && !text.endsWith('\n')) {
text += '\n';
}
text += `${line}\n`;
}
}
fs.writeFileSync(path, text);
EOF
Refresh Stale Local Snapshot Files
These files are untracked local artifacts. Regenerate them after Vercel updates so they stay aligned with the dedicated environment clients.
If .env.development and .env.production are still carrying copied Google credentials from the deleted client, update or remove those local snapshots as well.
Verification Commands
1. Verify Vercel Environment Values
Pull each project's production envs to a temporary file, confirm the non-secret values, confirm the secret exists, then delete the temp file.
vercel link --scope "$VERCEL_SCOPE" --project stratofusion-dev --yes
vercel env pull .env.verify.stratofusion-dev --environment=production --yes --scope "$VERCEL_SCOPE"grep'^GOOGLE_CLIENT_ID=' .env.verify.stratofusion-dev
grep'^GOOGLE_REDIRECT_URI=' .env.verify.stratofusion-dev
grep'^GOOGLE_CLIENT_SECRET=' .env.verify.stratofusion-dev >/dev/null &&echo'GOOGLE_CLIENT_SECRET is present for stratofusion-dev'rm -f .env.verify.stratofusion-dev
vercel link --scope "$VERCEL_SCOPE" --project stratofusion-prod --yes
vercel env pull .env.verify.stratofusion-prod --environment=production --yes --scope "$VERCEL_SCOPE"grep'^GOOGLE_CLIENT_ID=' .env.verify.stratofusion-prod
grep'^GOOGLE_REDIRECT_URI=' .env.verify.stratofusion-prod
grep'^GOOGLE_CLIENT_SECRET=' .env.verify.stratofusion-prod >/dev/null &&echo'GOOGLE_CLIENT_SECRET is present for stratofusion-prod'rm -f .env.verify.stratofusion-prod
The app returns a JSON payload from /api/google containing the Google auth URL. This checks the deployed route is emitting the correct client_id, redirect_uri, and prompt.