credOclock
Email reminders before your team's API keys, SSL certs, and
Posted a few weeks back about credOclock, a tool that tracks expiring API keys, SSL certs, and webhooks so your team gets a heads-up before something breaks instead of after.
Quick update on where it's at.
Shipped since launch:
Auto SSL detection, ack/snooze links right in the reminder email, and Slack/Discord/Teams alerts, all live and tested for real, not just in my own head.
Rotation tracking. A credential can have its own rotation schedule, separate from its expiry date, and get flagged if it's overdue. Turns out "the automation that rotates this key quietly stopped working three months ago" is its own failure mode, distinct from "this is about to expire."
The bigger one: real role-based permissions (Admin, Member, Viewer) and per-client credential scoping. That second part specifically came out of thinking harder about who'd actually use this, agencies and MSPs managing infrastructure for multiple clients out of one team, who need to control who on their own team can see which client's stuff. Wasn't part of the original plan, became obvious once I thought about the actual buyer.
Also ran a proper security pass on the whole thing and fixed what needed fixing. Not going to list specifics publicly, that's not a flex, it's just common sense, but it's part of why I'm comfortable saying this is solid enough for a real team to actually use now.
Still true from the first post: genuinely no idea yet if this is a problem other teams actually feel, or if it was mostly my own itch. Free tier's still there, 5 credentials, no card. If you've ever had a cert lapse on a Saturday or a key nobody remembered to rotate, curious if this is useful or if I'm solving a problem that doesn't really exist outside my own head.
credoclock.com if you want to look. Feedback, especially the "this doesn't solve my actual problem" kind, is genuinely welcome.
credOclock tracks credentials that expire — API keys, SSL certs, webhooks,
anything with a shelf life — and emails your whole team before they lapse.
No vault, no secret storage, just a heads up before something breaks.
Built it solo over the last few weeks. A few honest bumps along the way:
renamed the product twice after hitting name collisions, discovered my
hosting provider silently blocks outbound SMTP below their paid tier
(switched to an HTTP email API instead), and found out Stripe doesn't support merchant accounts in my country. Tried Lemon Squeezy first, got rejected after review with no specific reason given — seemingly a common experience for new sellers there. Landed on Paddle instead, which also handles international tax compliance, with a much smoother approval process.
It's live now at credoclock.com. Free tier, 5 credentials, no card
required. Zero real users yet outside my own testing — genuinely curious
whether this is a problem other teams actually have, or if I've just been
unlucky. Feedback, brutal or otherwise, is very welcome.
-
1
The no-reason LS reject is them deciding whether they want their name on the receipt, not whether the product is any good. Paddle being smoother is luck of the risk model.
-
1
That make sense too! Good point!
-
-
1
The “finding out an API key expired the hard way” problem is easy to understand. Curious what kind of credential people seem most interested in tracking first.
-
1
Good question. Honestly still figuring that out myself. So far it's been a mix: API keys people forgot they had, SSL certs on stuff outside their normal renewal pipeline, and a couple of people mentioning domain renewals too. If you have got a specific one that bit you before, I would love to hear it — helps me figure out what to prioritize next.
-
1
That’s a useful mix already. I’d be interested in continuing the conversation as you figure out which credential type has the strongest pull — what’s the best email to reach you at?
-
1
Happy to keep talking through it — easiest is support@credoclock.com, that inbox actually reaches me directly. Feel free to drop a note there whenever something comes to mind.
-
1
Thanks! I’ve just sent it over.
Looking forward to hearing your thoughts whenever you have a chance.
-
-
-
-
-
1
The expiry problem is real - a cert or key dying on a weekend is a classic infra incident. I'd position TLS certs specifically as the last line of defense alongside automated renewal (ACME) rather than a replacement, and the SMTP-blocked-free-tier + Stripe country limit pivots are painfully relatable. Nice to see an HTTP email API + Lemon Squeezy as the escape hatch.
-
1
Quick update since this comment — ended up moving off Lemon Squeezy to Paddle. Lemon Squeezy rejected my store application after review with no specific reason, which seems to be a common pattern for new sellers there. Paddle's been a smoother process for the same merchant-of-record setup.
-
1
Really sharp point, thank you. You are right, ACME/automated renewal already solves the "did the cert get renewed" problem for most setups. Where credOclock actually earns its keep is the last-line-of-defense case: renewal silently failing, a cert you don't fully control (third-party vendor, internal service, something manual), or just catching it before it becomes a 2am incident. I will adjust the framing to reflect that instead of implying it replaces ACME. Appreciate you pushing on it, that's exactly the kind of feedback that makes the product better.
-
Comment