cambium-auth-credentials

What problem does it solve?

Provides clear, operational guidance to prevent and recover from authentication and credential failures in the Cambium service, reducing deployment outages caused by misconfigured connection strings, missing JWT secrets, or accidental admin overrides.

Core Features & Use Cases

• Credential safety rules: Enforces Railway Variable Reference usage for DATABASE_URL and documents blast radius implications for hardcoded connection strings.
• Admin recovery pattern: Explains the emergency ADMIN_DEFAULT_PASSWORD override, how to perform a safe recovery, and the requirement to remove the env var immediately after use.
• Auth architecture guidance: Describes the dual JWT + Cookie scheme, DataProtection key handling, token expiry behavior, and common 401 causes.
• Pre-push checklist: Step-by-step verification items to run before pushing to main, including schema checks, build/tests, and env var validations.

Quick Start

Verify that Railway Variables contain DATABASE_URL set to ${Postgres.DATABASE_URL}, confirm JWT_SECRET_KEY is present, and run the pre-push checklist before deploying to Railway.