It was the keys. It was always the keys.
The success of an agency is measured by the circumference of its digital key ring.
Last week I spent four days sorting out how we store client passwords and API keys. Four days. On password management — the single least glamorous thing on the board, the kind of task you’d hand to whoever joined most recently.
Best time I’ve spent this year, and it isn’t close.
Here’s why, and I’m going to spell it out because it took me an embarrassing number of years to see it.
The thing we sell, and the twenty doors it needs
We build what I call a Cosmic: one client’s entire data operation, running by itself. It pulls their numbers out of every system they use, on a schedule, without anyone remembering to do it. It cleans them up, works out what they mean, publishes the result somewhere the client actually looks, and files the raw copy away in case anyone ever asks where a number came from.
That’s it. That’s the product. Nothing about it is clever.
And it needs somewhere near twenty keys to exist. A key here is a password or an access token — the credential that lets our software log into one of their systems and read data without a human doing it by hand. Google Ads is one. Their analytics is another. The ad platforms, the CRM, the payment processor, the email tool, the call tracking, the spreadsheet somebody in finance actually runs the business from. Twenty of them.
That number isn’t one I picked, and it’s not arbitrary either. It’s roughly how many plugins it used to take to run a WordPress site, back when running a WordPress site was a job. The plugins went away. The surface area didn’t. There are still twenty things, they still all need letting in, and somebody still has to say yes twenty times.
I’ve been the guy on the left for a long time. The job on the right is the one holding the whole thing up, and I kept handing it to somebody else.
Twenty yeses is the entire problem
I’ve had the design for that pipeline sitting in my head for years. Not a vague ambition — the actual thing, in order, with the hard parts identified.
What stopped me building it was never the scheduling. It was never the transformations, or where to put the data, or any of the parts that would look impressive if I described them at a conference.
It was keys. It was always keys.
You cannot write line one of the code that pulls a client’s data until you are holding the credential that opens their account. Not “have requested.” Not “have a ticket open with their IT guy.” Holding it. Until then, the most beautiful pipeline ever designed is a drawing of a pipeline, and I have a folder full of those.
The part I’d say to a client’s face
Now the harder version, and I’ll say it plainly because dressing it up helps nobody.
If it takes three weeks to get a key to your own data — data about your own customers, generated by money you already spent — that is not a paperwork delay. That is the clearest possible evidence that your IT department and your ad agency are not set up to grow your business.
Nobody has to make that argument. The calendar makes it. Three weeks is the whole case, and everyone in the room can already do the arithmetic.
I’m not being clever at anyone’s expense here. I ran an agency that was slow about exactly this, and the reason I can describe the symptom so precisely is that I had it.
So it starts with a key ring
Which is why today’s work — which honestly looks like an afternoon of fiddling with editor settings — is step one of all of it.
What that screenshot shows: my editor’s configuration file, with zero
matches for anything resembling a GitHub password. Where the password would
normally sit, there’s a pointer that reads op://status26/.... That’s an
address in 1Password, not a secret. The real key gets fetched from the vault
at the moment the editor starts, used, and never written down anywhere.
I took a picture of my own credentials file and published it. That’s the entire point — if that screenshot could hurt me, the setup would be wrong.
That’s the pattern the other nineteen have to follow. Not “store the password somewhere safe,” which is what everybody says and nobody checks. A pointer in the config, the real thing fetched when it’s needed, and nothing on disk that would matter if I left my laptop in a taxi.
The record is the product
Six commits and a version number. It looks like nothing.
It’s the whole argument. Something happened, and it left proof that it
happened, in an order, with the reasoning attached. Publish the record,
archive the raw. That’s what I said a Cosmic does for a client’s data, and
there’s no version of me selling that to anyone while my own key management
lives in a spreadsheet called passwords_FINAL_v2.
Key management isn’t the boring chore you get through before the interesting work starts. It’s stage one of the same machine. I treated it as overhead for about a decade, which I think earns me the right to be loud about it now.