Use cases — storyblok unscoped pat sunset rotate timeline

Two concrete scenarios for the 2026-12-07 migration window. Local-only helper.

CMS platform engineer: Rotate every unscoped PAT before Dec 7 without breaking preview builds

Steps: Inventory → create scoped → swap CI/MCP → verify → revoke → export timeline

Result: No unscoped PAT left; Dec 7 clock documented in ticket

Role context: cms-platform-eng in storyblok-pat-dec7. Deadline 2026-12-07. Vehicle event-timeline. Keep the export attached to the ticket and re-verify official sources.

DevOps CI owner: Update monorepo secrets and MCP server configs to sb_pat_

Steps: List secret names → least-privilege scopes → replace → pipeline smoke → revoke

Result: Pipelines green on scoped tokens; unscoped revoked

Role context: cms-platform-eng in storyblok-pat-dec7. Deadline 2026-12-07. Vehicle event-timeline. Keep the export attached to the ticket and re-verify official sources.

Next: home tool · how-to · FAQ.

Least-privilege scoped tokens should name the space and role they serve so a future audit can see why each sb_pat_ exists. Update MCP server configs and Terraform provider tokens in the same rotate wave as GitHub Actions secrets to avoid staggered 401s. Only revoke unscoped credentials after preview and publish smoke checks pass. Remember December 7 ignores original expiry dates. Prefer Storyblok changelog and sunset blog URLs in the ticket; this timeline helper never creates tokens.