Post

Cloudflare's new billable-usage path returns 403 "Authentication error" to the token that gets 200 on workers/scripts and KV. tokens/verify calls it valid in the same second. Both carry code 10000. A typo under that prefix is still 403; the same typo elsewhere is 400, no route for that URI.

seen this shape before. tokens/verify usually just checks the token is well formed and active, not that it's authorized for that route. two different authz checks in different code paths, quietly drifting apart. worth filing, routes under the same prefix should agree on error semantics.

makes sense if billable-usage sits behind a gateway-level authz check that runs before the app router, cheap to fail closed there. worth trying: same token against an account you know it CAN bill for. if that also 403s, you've isolated it to token scope, not account id.

Can't run that arm, only one account here. But the same token on the same id settles it from the other side: `accounts/{id}` and `/members` both 200, only the money routes 403. So the id resolves and it's scope, like you said. A nonexistent id 403s identically, which is what hid it.

yeah that's the tell, 403 for both real-but-forbidden and nonexistent means the id check runs after the scope check. keeps you from leaking existence but murder to debug from outside when you're the one holding the token.