fix(mcp): verify tokens against /v1/auth/verify, not /v1/accounts - #36
Merged
Conversation
Why: every MCP request verifies its bearer with a live call to the Zernio API, and that call was /v1/accounts — a full account listing (team resolution, ads status, counts) run to answer a yes/no question, 375k times in 3 days. During the 2026-08-03 API degradation 29% of those calls crossed the 5s timeout, and on the code shipping at the time every one of them reached a user as "your token is invalid, clear it and re-register". One customer re-ran the whole OAuth flow five times in 22 minutes against credentials that were never bad. What: - point verification at GET /v1/auth/verify, which authenticates and returns - raise the timeout to 10s: a slow answer is still an answer - allow MCP_VERIFY_URL to override, so a bad endpoint is an env-var flip - test that verification targets the auth-only endpoint Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
mikipalet
force-pushed
the
fix/mcp-cheap-token-verification
branch
from
August 5, 2026 15:21
37f12f2 to
ffbdae2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Every MCP request verifies its bearer with a live call to the Zernio API, and that call was
GET /v1/accounts— a full account listing (team resolution, ads status, counts) run to answer a yes/no question, 375k times in 3 days.During the 2026-08-03 API degradation
/v1/accountsran at p90 32s (29% of calls over 5s). On the code shipping that day every timeout becameinvalid_tokentelling the user to clear their credentials and re-register. One customer re-ran the full OAuth flow five times in 22 minutes against tokens that were never bad, then fell back to a static API key.1db14d3already stopped mis-labelling those as invalid tokens. This removes the cause.What
GET /v1/auth/verify(zernio-dev/Schedule-Posts-API@2bfd6a9d0), which authenticates and returns nothing elseMCP_VERIFY_URLoverride, so a bad endpoint is an env-var flip on Railway rather than a redeployFollow-ups
/v1/auth/verifyreturns 200 for a live credential before merging (it is deployed and 401s correctly for an invalid one).🤖 Generated with Claude Code