# Secrets & config checklist (names only — NO values in this repo)

Each Cloudflare Worker needs these set via `wrangler secret put <NAME>` (secrets) or in `wrangler.toml [vars]` (non-secret config). Extracted from source.

### homa-lab-customer-match-sync
`DM_CLIENT_ID`, `DM_CLIENT_SECRET`, `DM_LOGIN_ACCOUNT`, `DM_OPERATING_ACCOUNT`, `DM_REFRESH_TOKEN`, `GOOGLE_OAUTH_CLIENT_ID`, `GOOGLE_OAUTH_CLIENT_SECRET`, `GOOGLE_OAUTH_REFRESH_TOKEN`, `HEARTBEAT`, `MANUAL_TRIGGER_TOKEN`, `POSTHOG_API_KEY`, `POSTHOG_HOST`, `POSTHOG_PROJECT_ID`, `SLACK_SUCCESS_NOTIFY`, `SLACK_WEBHOOK_URL`, `WORKER_SLUG`

### homa-lab-meta-audience-sync
`KV`, `MANUAL_TRIGGER_TOKEN`, `META_TOKEN`, `POSTHOG_API_KEY`, `POSTHOG_HOST`, `POSTHOG_PROJECT_ID`, `SLACK_WEBHOOK_URL`

### homa-metro-go
(none)

### lab-daily-report
`GADS_CID`, `GADS_CLIENT_ID`, `GADS_CLIENT_SECRET`, `GADS_DEV_TOKEN`, `GADS_LOGIN_CID`, `GADS_REFRESH_TOKEN`, `POSTHOG_KEY`, `RESEND_KEY`, `SLACK_WEBHOOK`

### lab-live-dashboard
`GOOGLE_ADS_CLIENT_ID`, `GOOGLE_ADS_CLIENT_SECRET`, `GOOGLE_ADS_CUSTOMER_ID`, `GOOGLE_ADS_DEVELOPER_TOKEN`, `GOOGLE_ADS_LOGIN_CUSTOMER_ID`, `GOOGLE_ADS_REFRESH_TOKEN`, `KV`, `META_TOKEN`, `POSTHOG_KEY`, `REDDIT_APP_ID`, `REDDIT_REFRESH_TOKEN`, `REDDIT_SECRET`, `REFRESH_TOKEN`

### signal-audiences
`META_AUTOMATION_TOKEN`, `POSTHOG_KEY`, `RUN_TOKEN`, `SIG_KV`, `SLACK_WEBHOOK`

### sitewide-dashboard
`GOOGLE_ADS_CLIENT_ID`, `GOOGLE_ADS_CLIENT_SECRET`, `GOOGLE_ADS_CUSTOMER_ID`, `GOOGLE_ADS_DEVELOPER_TOKEN`, `GOOGLE_ADS_LOGIN_CUSTOMER_ID`, `GOOGLE_ADS_REFRESH_TOKEN`, `KV`, `META_TOKEN`, `POSTHOG_KEY`, `REFRESH_TOKEN`

## Cron scripts (launchd → must be re-hosted, see REHOST.md)

These read credentials from files on the ops machine (`~/.homa-*`). Referenced cred files:

- `~/.homa-meta-creds`
- `~/.homa-posthog-query-key`
- `~/.homa-reddit-creds`
- `~/homa-capi-sync`
- `~/homa-capi-sync/behavioral_cas.json`
- `~/homa-capi-sync/capi_sent.jsonl`
- `~/homa-capi-sync/capi_sync.log`
- `~/homa-capi-sync/catalog_state.json`
- `~/homa-capi-sync/catalog_sync.log`
- `~/homa-capi-sync/reddit_capi_sent.jsonl`
- `~/homa-capi-sync/reddit_capi_sync.log`
- `~/homa-capi-sync/reddit_state.json`
- `~/homa-capi-sync/refresh.log`
- `~/homa-capi-sync/state.json`