---
title: Airtable PAT Rotation SOP
created: 2026-05-06
type: sop
applies_to: hermes-vps-rw-v1 (Hermes + OpenClaw OpsMan shared PAT)
---

# Airtable PAT Rotation — Hermes + OpenClaw OpsMan

PAT `hermes-vps-rw-v1` leaked into a Claude conversation transcript on 2026-05-05.
Rotate within 30 days (deadline ~2026-06-04) with **trimmed scopes**.

The PAT is shared between Hermes (`/root/.hermes/config.yaml`) and OpenClaw OpsMan
(`/root/.clawdbot-opsman/openclaw.json`). Both surfaces use the same value — rotate
both in lockstep.

## Rocky's Airtable UI steps

1. Go to <https://airtable.com/create/tokens> while signed in as the LFCS-Operations
   base owner.
2. Click **Create new token**.
3. **Name:** `hermes-vps-rw-v2` (increment the version suffix).
4. **Scopes** — tick exactly these six and **nothing else**:
   - `data.records:read`
   - `data.records:write`
   - `data.recordComments:read`
   - `data.recordComments:write`
   - `schema.bases:read`
   - `workspacesAndBases:read`

   Scopes deliberately **not granted** (vs. v1):
   - ~~`schema.bases:write`~~ (schema changes are claude-code-coo's lane)
   - ~~`webhook:manage`~~
   - ~~`block:manage`~~
   - ~~`user.email:read`~~

5. **Access:** select **Add a base** → choose `LFCS-Operations`
   (`appE43UvTyARe5oJs`). Do NOT grant access to all bases or workspaces.

6. Click **Create token**. Copy the value (`pat...`). Keep it in your password
   manager only — do NOT paste into chat.

7. Pass the token to claude-code-opsman via SSH-only path (e.g. `op://Private/...`
   or a file Rocky writes directly to the VPS over SSH). The token must NOT pass
   through Claude transcripts.

## Operator (claude-code-opsman) steps once new PAT is in hand

Run on the VPS as `root`. Replace `<NEW_PAT>` with the new value (do not echo).

```bash
NEW_PAT='<NEW_PAT>'
OLD_PAT_PREFIX='patIQTejsB6G3elZs'  # for grep verification

# 1. Backup both configs (timestamped)
ts=$(date -u +%Y%m%dT%H%M%SZ)
cp /root/.hermes/config.yaml         /root/.hermes/config.yaml.bak.$ts
cp /root/.clawdbot-opsman/openclaw.json /root/.clawdbot-opsman/openclaw.json.bak.$ts

# 2. Sed-in-place replacement on Hermes (yaml)
sed -i "s|AIRTABLE_API_KEY: $OLD_PAT_PREFIX[^[:space:]]*|AIRTABLE_API_KEY: $NEW_PAT|" \
  /root/.hermes/config.yaml

# 3. Sed-in-place replacement on OpenClaw OpsMan (json)
sed -i "s|\"AIRTABLE_API_KEY\": \"$OLD_PAT_PREFIX[^\"]*\"|\"AIRTABLE_API_KEY\": \"$NEW_PAT\"|" \
  /root/.clawdbot-opsman/openclaw.json

# 4. Verify old prefix is gone from both files
grep -c "$OLD_PAT_PREFIX" /root/.hermes/config.yaml         # must be 0
grep -c "$OLD_PAT_PREFIX" /root/.clawdbot-opsman/openclaw.json  # must be 0

# 5. Restart services
systemctl restart hermes-gateway
systemctl restart clawdbot-opsman

# 6. Smoke test — Hermes MCP
sleep 5
hermes mcp ping airtable 2>&1 | head -5

# 7. Smoke test — OpenClaw OpsMan MCP
CLAWDBOT_STATE_DIR=/root/.clawdbot-opsman openclaw mcp test airtable 2>&1 | head -5

# 8. Clear NEW_PAT from shell history
history -d $(history 1)
unset NEW_PAT
```

## Rocky's final cleanup

Once smoke tests pass:

1. Go to <https://airtable.com/create/tokens>
2. Find `hermes-vps-rw-v1`
3. Click **Revoke** — this is irreversible
4. The leaked PAT becomes inert immediately

## Post-rotation log

Append to `HQ-Vault/_System/AgentLog/events.ndjson` via `scripts/log-event.sh`:

```bash
bash scripts/log-event.sh claude-code-opsman security_finding \
  "airtable-pat:hermes-vps-rw-v1" ok \
  "Rotated to v2 with trimmed scopes (records r/w + recordComments r/w + schema:read + workspacesAndBases:read). v1 revoked in Airtable UI. Hermes + OpenClaw OpsMan smoke-tested OK."
```

And to `HQ-Vault/11_OpsMan_LFCS/_Brain/_Log.md` (append-only one-liner):

```
- 2026-MM-DD HH:MM — claude-code-opsman — Airtable PAT rotated v1→v2 (trimmed scopes, leaked-key revoked) → [[01_Daily/2026-MM-DD]]
```

## Verification checklist

- [ ] New PAT created with exactly 6 scopes (no extras)
- [ ] Access scoped to LFCS-Operations base only
- [ ] `/root/.hermes/config.yaml` has new PAT, no trace of old prefix
- [ ] `/root/.clawdbot-opsman/openclaw.json` has new PAT, no trace of old prefix
- [ ] `hermes-gateway` restarted + Airtable MCP ping passes
- [ ] `clawdbot-opsman` restarted + Airtable MCP test passes
- [ ] Old PAT (`hermes-vps-rw-v1`) revoked in Airtable UI
- [ ] Backups (`*.bak.YYYYMMDDTHHMMSSZ`) deleted after 7-day cooling period
- [ ] Event logged to `events.ndjson` + `_Brain/_Log.md`