search

GSA / 889-tool

Web service for determining 889 compliance of vendors
1 stars 0 forks source link

On-Going Rotation of SAM API Keys #6

Open mark-meyer opened 1 year ago

mark-meyer commented 1 year ago

The API key we are using for this expires periodically. It's not difficult to rotate the keys, but at the moment it requires logging into SAM.gov to get the new key, then logging into Cloud.gov to change the environmental variable. In the future this may prove onerous for SmartPay's team and easy forget about.

It's not clear if there is a way to automate this, but it's worth exploring options for making this less manual.

From Mark Meyer on 10/23/23: "This is something you (or your vendor will need to pay attention to). For the 889 tool to get information from SAM.gov it needs a secret key that it passes with requests to the API to identify the request as coming from SmartPay. SAM forces us to change this key periodically which means we need to:

  1. have someone with access to the SmartPay SAM system account log into the SAM.gov console and get the new key
  2. change a setting (an environmental variable) on the 889 tool and restage the app

I have already done this for this cycle, so we should be good to go for a few months. Once the folks from KL&A have .gov email addresses, we should be able to add them to the SAM account (I'm assuming this is true)."

JessicaMarine1 commented 10 months ago

@rebekahperillo adding this to the 889 project. This is something your vendor will need to do periodically.