claude-code-secrets-renovator

A CLI tool to manage Claude AI OAuth secrets across multiple GitHub repositories.

Prerequisites

• Bun runtime installed (for development)
• GitHub Personal Access Token with repo scope
• Claude credentials file at ~/.claude/.credentials.json

Installation

From Source

bun install

Build Binary (Linux)

make build
# Binary will be created at dist/claude-secrets-renovator

Usage

First Time Setup

1. Authenticate with GitHub:

   bun run src/main.ts auth
   # Or with binary: ./claude-secrets-renovator auth

   You'll be prompted to enter:

   • Your GitHub Personal Access Token (with repo scope)
   • Your GitHub organization/username

   Both will be securely stored for future use.

2. Check status:

   bun run src/main.ts status

Updating Secrets

The tool provides multiple ways to update secrets:

1. Update specific repositories:

   bun run src/main.ts update repo1 repo2 repo3

2. Interactive selection:

   bun run src/main.ts update --interactive
   # Or just: bun run src/main.ts update

3. Update all repositories:

   bun run src/main.ts update --all

Commands

• auth - Authenticate with GitHub
• logout - Remove stored GitHub credentials
• update [repos...] - Update Claude secrets in repositories
  • --all, -a - Update all repositories
  • --interactive, -i - Select repositories interactively
• status - Check authentication and credentials status
• monitor - Monitor and auto-refresh credentials (long-running process)
• service - Generate and install systemd service for automatic monitoring
  • --user <username> - User to run the service as (default: current user)
  • --install - Install the service after generation
  • --enable - Enable the service to start on boot
  • --start - Start the service immediately
• help - Show help information

What it does

This tool reads your Claude OAuth credentials from ~/.claude/.credentials.json and updates the following secrets in each specified repository:

• CLAUDE_ACCESS_TOKEN
• CLAUDE_REFRESH_TOKEN
• CLAUDE_EXPIRES_AT

The secrets are encrypted using GitHub's public key before being stored.

Security

• GitHub tokens are stored locally in ~/.claude-secrets-renovator/config.json
• Tokens are never logged or exposed
• All secrets are encrypted before being sent to GitHub

Building

To build a standalone binary for Linux:

make build

To install system-wide:

make install  # Requires sudo

Running as a Linux Service

The tool includes a monitor command that continuously watches for expiring Claude credentials and automatically refreshes them. You can run this as a systemd service to ensure your GitHub secrets are always up-to-date.

Prerequisites

First, build and install the binary:

make build
sudo make install

Quick Setup

To set up the monitor as a systemd service:

# Generate, install, enable, and start the service (requires sudo)
sudo claude-secrets-renovator service --install --enable --start

This will:

1. Create a systemd service file at /etc/systemd/system/claude-secrets-renovator@yourusername.service
2. Enable the service to start on boot
3. Start the service immediately

Manual Setup

If you prefer to set up the service manually:

1. Generate the service file:

   claude-secrets-renovator service

2. Create the systemd service file: Save the generated content to /etc/systemd/system/claude-secrets-renovator@yourusername.service

3. Enable and start the service:

   sudo systemctl daemon-reload
   sudo systemctl enable claude-secrets-renovator@yourusername.service
   sudo systemctl start claude-secrets-renovator@yourusername.service

Service Management

Once installed, you can manage the service with these commands:

# Check service status
sudo systemctl status claude-secrets-renovator@yourusername

# View logs
sudo journalctl -u claude-secrets-renovator@yourusername -f

# Stop the service
sudo systemctl stop claude-secrets-renovator@yourusername

# Restart the service
sudo systemctl restart claude-secrets-renovator@yourusername

# Disable automatic startup
sudo systemctl disable claude-secrets-renovator@yourusername

What the Monitor Does

The monitor service:

• Checks your Claude credentials every time they're close to expiring (within 5 minutes)
• Automatically refreshes expired credentials
• Updates all configured GitHub repositories with the new credentials
• Runs continuously in the background
• Retries failed operations after 1 hour