◷ Unscoped PAT rotate

Dec 7 revoke clock · scoped sb_pat_ · replace-before-revoke

Storyblok unscoped PAT sunset rotate timeline

1 Create sb_pat_ 2 Replace CI/MCP 3 Verify callers 4 Revoke unscoped Dec 7 hard revoke
SurfaceOwnerScoped?Replaced?
 

    

    
  

  





How it works


    

  1. Add each CI/script/MCP surface that still holds an unscoped PAT.
    2. 

  2. Advance the rotate timeline: create scoped → replace → verify → revoke.
    3. 

  3. Export Markdown before the Dec 7 hard revoke — we never call Storyblok.
    4. 



Storyblok moves the unscoped PAT sunset to December 7, 2026 and revokes all remaining unscoped tokens that day.


vs OAuth discovery / GCM force-upgrade: axes are Dec7 clock ∩ sb_pat_ ∩ replace-before-revoke — not OAuth PRM JSON or desktop credential managers.


Next: how-to · FAQ · use cases.