Launching credOclock — stop finding out an API key expired the hard way
credOclock tracks credentials that expire — API keys, SSL certs, webhooks,
anything with a shelf life — and emails your whole team before they lapse.
No vault, no secret storage, just a heads up before something breaks.
Built it solo over the last few weeks. A few honest bumps along the way:
renamed the product twice after hitting name collisions, discovered my
hosting provider silently blocks outbound SMTP below their paid tier
(switched to an HTTP email API instead), and found out Stripe doesn't support merchant accounts in my country. Tried Lemon Squeezy first, got rejected after review with no specific reason given — seemingly a common experience for new sellers there. Landed on Paddle instead, which also handles international tax compliance, with a much smoother approval process.
It's live now at credoclock.com. Free tier, 5 credentials, no card
required. Zero real users yet outside my own testing — genuinely curious
whether this is a problem other teams actually have, or if I've just been
unlucky. Feedback, brutal or otherwise, is very welcome.
The no-reason LS reject is them deciding whether they want their name on the receipt, not whether the product is any good. Paddle being smoother is luck of the risk model.
That make sense too! Good point!
The “finding out an API key expired the hard way” problem is easy to understand. Curious what kind of credential people seem most interested in tracking first.
Good question. Honestly still figuring that out myself. So far it's been a mix: API keys people forgot they had, SSL certs on stuff outside their normal renewal pipeline, and a couple of people mentioning domain renewals too. If you have got a specific one that bit you before, I would love to hear it — helps me figure out what to prioritize next.
That’s a useful mix already. I’d be interested in continuing the conversation as you figure out which credential type has the strongest pull — what’s the best email to reach you at?
Happy to keep talking through it — easiest is support@credoclock.com, that inbox actually reaches me directly. Feel free to drop a note there whenever something comes to mind.
Thanks! I’ve just sent it over.
Looking forward to hearing your thoughts whenever you have a chance.
The expiry problem is real - a cert or key dying on a weekend is a classic infra incident. I'd position TLS certs specifically as the last line of defense alongside automated renewal (ACME) rather than a replacement, and the SMTP-blocked-free-tier + Stripe country limit pivots are painfully relatable. Nice to see an HTTP email API + Lemon Squeezy as the escape hatch.
Quick update since this comment — ended up moving off Lemon Squeezy to Paddle. Lemon Squeezy rejected my store application after review with no specific reason, which seems to be a common pattern for new sellers there. Paddle's been a smoother process for the same merchant-of-record setup.
Really sharp point, thank you. You are right, ACME/automated renewal already solves the "did the cert get renewed" problem for most setups. Where credOclock actually earns its keep is the last-line-of-defense case: renewal silently failing, a cert you don't fully control (third-party vendor, internal service, something manual), or just catching it before it becomes a 2am incident. I will adjust the framing to reflect that instead of implying it replaces ACME. Appreciate you pushing on it, that's exactly the kind of feedback that makes the product better.