Apple Sign-In Breaks Every 6 Months Due to Expiring JWT Client Secret

·6 views

Developers using Sign in with Apple on the web may find authentication suddenly failing with an 'invalid_client' error approximately six months after setup, caused by Apple's mandatory expiry limit on JWT client secrets. Unlike other OAuth providers such as Google or GitHub, Apple requires developers to manually generate a time-limited JWT signed with a private .p8 key, which expires after a maximum of roughly 15.7 million seconds. Apple sends no warning when the secret expires, meaning users typically encounter the failure before developers do. The standard fix involves generating a fresh JWT and updating it in the authentication provider's dashboard, but this must be repeated every six months. To automate the process, a GitHub Action called apple-client-secret-rotator has been released, which regenerates and updates the secret on a scheduled basis, eliminating the need for manual intervention.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer runs 36 controlled tests to decode silent MCP widget rendering failures

A developer investigated a widespread but poorly documented bug where MCP App widgets silently fail to render on claude.ai despite successful tool calls and correct server responses. To study the black-box host environment without access to source code or a debugger, they built a probe server and ran 36 structured experiments on July 31, 2026. A key community-suggested fix — adding a sha256-derived domain value to the resource's _meta.ui.domain field — turned out to be risky if applied imprecisely, as a slightly incorrect value completely blocks iframe creation rather than helping. The investigation also revealed that a static visual marker requiring no JavaScript was the critical technique for determining whether the host ever created an iframe at all, eliminating entire categories of false diagnoses. The author notes that host behavior can change over time and that their own measurement data misled them twice during the process, underscoring the difficulty of debugging opaque rendering environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Row-Level Data Provenance: Why Tracking Exact Values Matters More Than Column Lineage

A software developer has built a self-contained reference pipeline using dbt-core and DuckDB that captures data provenance at the row and field level, going beyond the schema-level lineage offered by tools like OpenLineage. While column-level lineage is a static fact derived from code and scales with schema size, value-level provenance is dynamic, must be captured at query execution time, and scales with data volume multiplied by source inputs per output. This fundamental difference in complexity creates an entirely new class of engineering challenges, including storage costs that can dwarf the original data if handled naively. The project addresses these challenges by storing predicates that describe contributing data sets rather than recording every individual contributing row. Key use cases include faster debugging of incorrect values, scoping the impact of data corrections, supporting compliance requirements, and surfacing uncertain or unverified data lineage rather than returning silently misleading results.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Solo dev builds remote pricing switch for Chrome extension to skip store review delays

A solo developer building NotebookBloom, a Chrome extension for Google's NotebookLM, designed a server-free remote paywall system to avoid being bottlenecked by Chrome Web Store review queues whenever pricing changes. Since the extension runs entirely in the browser with no backend, hardcoding feature gates would require a full rebuild and resubmission for every pricing update. Instead, the developer stores feature gate values in a Cloudflare Worker's KV store and piggybacks them onto an existing subscription-check API call, adding no extra network requests. A three-layer fallback — KV store, local cache, then compiled defaults — ensures features remain accessible even if the remote server is unavailable. A Chrome alarms timer combined with a 24-hour throttle ensures pricing changes propagate to nearly all users within 24 to 36 hours without any manual intervention.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

TimescaleDB 2.27 Brings Bloom Filter Pruning to Writes, but EXPLAIN Counters Can Mislead

TimescaleDB 2.27, released May 12, 2026, extends bloom-filter batch pruning to write operations, allowing UPDATE, DELETE, and UPSERT queries on compressed columnstore data to skip irrelevant batches without decompressing them. The feature can deliver up to 160x speedups for selective UPDATE and DELETE operations, and over 2x improvements for UPSERT. While the optimization is automatic, users must inspect new EXPLAIN (ANALYZE) counters to confirm it is actually firing on their workload. A key source of confusion is that the UPDATE/DELETE path and the UPSERT path use different counter names for the same underlying metrics, with no reconciliation in the official documentation. Developers upgrading to 2.27 are also warned that two undocumented behavioral changes in the release can silently break existing queries if not accounted for.

0 comments Read more at DEV Community