# Firebase service account key rotation (arafstore-14938)

The service account private key was distributed outside secure storage (e.g. chat). **Rotate it before or immediately after production go-live.**

## Steps

1. Open [Google Cloud Console](https://console.cloud.google.com/) → project **arafstore-14938**.
2. **IAM & Admin** → **Service Accounts** → `firebase-adminsdk-fbsvc@arafstore-14938.iam.gserviceaccount.com`.
3. **Keys** tab → delete key id `7b344d0c41db87bd3251080af6aa240c38076c37` (or any key you no longer trust).
4. Firebase Console → **Project settings** → **Service accounts** → **Generate new private key**.
5. Replace both local files (never commit):
   - `api/firebase-service-account.local.json`
   - `super-admin-panel/api/firebase-service-account.local.json`
6. Re-upload the same two paths on production (see `deploy/firebase-server-files/README-DEPLOY.txt`).
7. Run PHP smoke test on server; expect `OK`.
8. Delete any copies in Downloads, WhatsApp transfers, or email attachments.

## Never

- Commit `firebase-service-account.local.json` to git (already in `.gitignore`).
- Paste the JSON in tickets, screenshots, or public URLs.
