kinemotion 0.33.2__tar.gz → 0.34.0__tar.gz

kinemotion-0.34.0/.basic-memory/api/supabase-authentication-setup-guide.md

@@ -0,0 +1,428 @@
+---
+title: Supabase Authentication Setup Guide
+type: note
+permalink: api/supabase-authentication-setup-guide-1
+tags:
+- '[''supabase'''
+- '''authentication'''
+- '''setup'''
+- '''api'''
+- '''documentation'']'
+---
+
+# Supabase Authentication Setup Guide
+
+## Overview
+
+Kinemotion now uses Supabase for authentication, providing secure user management with JWT tokens.
+
+**What's Included:**
+- ✅ Email/password authentication
+- ✅ JWT token validation in backend (RS256 + Auth server fallback)
+- ✅ Automatic user ID logging in all requests
+- ✅ Protected API endpoints
+- ✅ Works with `kinemotion.vercel.app` domain
+
+---
+
+## Important: JWT Signing Keys (Modern Approach)
+
+Supabase now uses **asymmetric JWT signing keys** (ES256/RS256) as the modern standard:
+
+| Type | Algorithm | Status | Verification Method |
+|------|-----------|--------|---------------------|
+| **Asymmetric** (modern) | ES256/RS256 | ✅ **Recommended** | JWKS endpoint |
+| **Symmetric** (legacy) | HS256 | ⚠️ Deprecated | Auth server fallback |
+
+**Our backend supports both automatically:**
+1. Tries asymmetric verification via JWKS endpoint first (modern)
+2. Falls back to Auth server verification if JWKS is empty (legacy compatibility)
+
+**To use the modern approach:**
+1. Supabase Dashboard → **Settings** → **JWT signing keys**
+2. Click **"Migrate JWT secret"** if you see it
+3. Then click **"Rotate keys"** to start using ES256
+
+> **Why ES256?** Faster verification, better security (public/private keys can't be forged), easier compliance (SOC2, HIPAA), and automatic key revocation via JWKS.
+
+---
+
+## Step 1: Create Supabase Project
+
+1. Go to [database.new](https://database.new) (official Supabase project creation URL)
+2. Sign in or create a Supabase account
+3. Create a new organization (if needed)
+4. Fill in project details:
+   - **Project name:** `kinemotion`
+   - **Database password:** (click "Generate a password" for a strong password)
+   - **Region:** Choose closest to your users (e.g., `us-east-1`)
+   - **Plan:** Free (50,000 MAUs included)
+5. Click **Create new project**
+6. Wait for project to be created (~2 minutes)
+
+> **Note:** New projects (created July 2025+) automatically use ES256 (asymmetric) signing keys. If you have an existing project with legacy JWT secret, migrate it: **Settings** → **JWT signing keys** → **Migrate JWT secret**.
+
+---
+
+## Step 2: Get Supabase Credentials
+
+Once your project is ready:
+
+1. Go to **Settings** (gear icon in sidebar)
+2. Click **API Keys** in the left menu
+3. Copy the following:
+
+| Credential | Location | Description |
+|------------|----------|-------------|
+| **Project URL** | Top of API Keys page | `https://xxx.supabase.co` |
+| **Publishable key** | Under "Publishable key" | Safe for frontend (starts with `sb_publishable_...`) |
+| **Secret key** | Under "Secret keys" | Server-side only (starts with `sb_secret_...`) |
+
+> **Key Format Change (2025):** New projects use the `sb_publishable_xxx` format. Legacy projects may still show JWT-style keys starting with `eyJ...`. Both formats work the same way.
+
+---
+
+## Step 3: Configure Authentication Settings
+
+### URL Configuration
+
+1. In Supabase dashboard, click **Authentication** in sidebar
+2. Click **URL Configuration** in the left menu
+3. Configure the following:
+
+| Setting | Value | Purpose |
+|---------|-------|---------|
+| **Site URL** | `https://kinemotion.vercel.app` | Default redirect after auth |
+| **Redirect URLs** | `https://kinemotion.vercel.app/**` | Production redirects |
+| | `http://localhost:5173/**` | Local development |
+
+> **Tip:** Use `/**` wildcard to allow all paths under your domain.
+
+### Email Provider
+
+1. Click **Providers** in the left menu
+2. **Email** provider is enabled by default
+3. *(Optional)* Configure email templates under **Email Templates**
+
+### Social Providers (Optional)
+
+1. Under **Providers**, enable Google, GitHub, etc.
+2. Follow the setup instructions for each provider
+
+---
+
+## Step 4: Frontend Environment Variables
+
+### Development (.env.local)
+
+Create `frontend/.env.local`:
+
+```bash
+VITE_SUPABASE_URL=https://your-project-id.supabase.co
+VITE_SUPABASE_ANON_KEY=sb_publishable_xxxxxxxxxxxxxxxxxxxxx
+VITE_API_URL=http://localhost:8000
+```
+
+> **Note:** New projects use `sb_publishable_xxx` format. Legacy projects may have JWT-style keys (`eyJ...`). Both formats work.
+
+### Production (Vercel)
+
+Add environment variables in Vercel dashboard:
+
+1. Go to your project on [vercel.com](https://vercel.com)
+2. Click **Settings** → **Environment Variables**
+3. Add the following:
+
+| Variable | Value | Environment |
+|----------|-------|-------------|
+| `VITE_SUPABASE_URL` | `https://xxx.supabase.co` | Production |
+| `VITE_SUPABASE_ANON_KEY` | Your publishable key | Production |
+| `VITE_API_URL` | `https://kinemotion-backend-xxx.run.app` | Production |
+
+4. Click **Save** for each variable
+
+---
+
+## Step 5: Backend Environment Variables
+
+### Development (.env)
+
+Create `backend/.env`:
+
+```bash
+# Required
+SUPABASE_URL=https://your-project.supabase.co
+
+# Optional (for Auth server fallback verification)
+SUPABASE_ANON_KEY=sb_publishable_xxxxxxxxxxxxxxxxxxxxx
+
+# Logging
+LOG_LEVEL=INFO
+JSON_LOGS=false
+```
+
+**Environment Variables Explained:**
+
+| Variable | Required | Description |
+|----------|----------|-------------|
+| `SUPABASE_URL` | Yes | Your project URL (e.g., `https://xxx.supabase.co`) |
+| `SUPABASE_ANON_KEY` | No | Anon/public key for Auth server fallback |
+
+> **Note:** JWT secret is NOT needed for new RS256 projects. The backend verifies tokens via the public JWKS endpoint (`/.well-known/jwks.json`).
+
+### Production (Cloud Run)
+
+**Step 1: Create secrets in Google Cloud**
+
+```bash
+# Set Supabase URL secret (required)
+echo -n "https://your-project-id.supabase.co" | \
+  gcloud secrets create SUPABASE_URL \
+  --data-file=- \
+  --project=kinemotion-backend
+
+# Set Anon key secret (optional, for Auth server fallback)
+echo -n "sb_publishable_xxxxxxxxxxxxxxxxxxxxx" | \
+  gcloud secrets create SUPABASE_ANON_KEY \
+  --data-file=- \
+  --project=kinemotion-backend
+
+# Grant Cloud Run service account access to secrets
+gcloud secrets add-iam-policy-binding SUPABASE_URL \
+  --member="serviceAccount:github-actions-deploy@kinemotion-backend.iam.gserviceaccount.com" \
+  --role="roles/secretmanager.secretAccessor" \
+  --project=kinemotion-backend
+
+gcloud secrets add-iam-policy-binding SUPABASE_ANON_KEY \
+  --member="serviceAccount:github-actions-deploy@kinemotion-backend.iam.gserviceaccount.com" \
+  --role="roles/secretmanager.secretAccessor" \
+  --project=kinemotion-backend
+```
+
+**Step 2: Update `.github/workflows/deploy-backend.yml`**
+
+Find the "Deploy to Cloud Run" step and update the `flags` section:
+
+```yaml
+- name: Deploy to Cloud Run
+  uses: google-github-actions/deploy-cloudrun@v3
+  with:
+    service: ${{ env.SERVICE_NAME }}
+    region: ${{ env.GCP_REGION }}
+    image: ${{ env.REGISTRY }}/${{ env.GCP_PROJECT_ID }}/${{ env.SERVICE_NAME }}:${{ github.sha }}
+    flags: |
+      --memory=2Gi
+      --allow-unauthenticated
+      --set-env-vars=CORS_ORIGINS=https://kinemotion.vercel.app,JSON_LOGS=true,LOG_LEVEL=INFO
+      --set-secrets=SUPABASE_URL=SUPABASE_URL:latest,SUPABASE_ANON_KEY=SUPABASE_ANON_KEY:latest
+```
+
+---
+
+## Step 6: Test Locally
+
+### Start Backend
+
+```bash
+cd backend
+source .env  # Load environment variables
+uv run uvicorn kinemotion_backend.app:app --reload
+```
+
+### Start Frontend
+
+```bash
+cd frontend
+yarn dev
+```
+
+### Test Authentication Flow
+
+1. Open `http://localhost:5173`
+2. Click "Sign Up"
+3. Enter email and password
+4. Check email for confirmation link
+5. Click confirmation link
+6. Sign in with credentials
+7. Upload a video to test authenticated API call
+
+---
+
+## Step 7: Deploy to Production
+
+### Deploy Backend
+
+```bash
+git add .
+git commit -m "feat: add Supabase authentication"
+git push origin main
+```
+
+GitHub Actions will automatically:
+- Run tests
+- Build Docker image
+- Deploy to Cloud Run
+- Configure with Supabase secrets
+
+### Deploy Frontend
+
+```bash
+cd frontend
+git push origin main
+```
+
+Vercel will automatically:
+- Build React app with Vite
+- Deploy to production
+- Use environment variables
+
+---
+
+## Verification
+
+### Check Logs (Backend)
+
+All requests will now include user information:
+
+```json
+{
+  "event": "request_started",
+  "request_id": "abc123...",
+  "user_id": "a1b2c3d4-e5f6...",
+  "user_email": "coach@example.com",
+  "method": "POST",
+  "path": "/api/analyze"
+}
+```
+
+### Test API Authentication
+
+```bash
+# Get token from browser console after sign in
+# (Run in browser console: supabase.auth.getSession())
+
+curl -X POST https://kinemotion-backend-xxx.run.app/api/analyze \
+  -H "Authorization: Bearer YOUR_TOKEN_HERE" \
+  -F "file=@video.mp4" \
+  -F "jump_type=cmj"
+```
+
+---
+
+## Troubleshooting
+
+### "Invalid token" errors
+
+**Cause:** Token expired or verification failed
+
+**Fix:**
+1. Tokens expire after 1 hour - sign in again
+2. Check browser console for auth errors
+3. Verify `SUPABASE_URL` is correct in backend env
+
+### "JWKS verification failed" in logs
+
+**Cause:** Project uses HS256 signing (legacy)
+
+**This is normal!** The backend automatically falls back to Auth server verification.
+
+**Fix (optional):**
+- Set `SUPABASE_ANON_KEY` for faster fallback verification
+- Or migrate to asymmetric keys: Supabase Dashboard → **Settings** → **JWT signing keys** → Click "Migrate JWT secret"
+
+### "CORS error" from API
+
+**Cause:** Backend not allowing frontend domain
+
+**Fix:**
+1. Verify `CORS_ORIGINS` includes your Vercel domain
+2. Redeploy backend with correct environment variable
+
+### Email confirmation not working
+
+**Cause:** Supabase email settings
+
+**Fix:**
+1. Supabase Dashboard → Authentication → Email Templates
+2. Verify "Confirm signup" template is enabled
+3. Check spam folder for confirmation email
+4. For development, check Supabase logs for email delivery status
+
+### Backend not validating tokens
+
+**Cause:** Missing `SUPABASE_URL` environment variable
+
+**Fix:**
+1. Check Cloud Run logs: `gcloud logging read --limit 50`
+2. Look for "supabase_auth_not_configured" warning
+3. Verify `SUPABASE_URL` secret is set in Google Secret Manager
+4. Redeploy with correct secret configuration
+
+### Tokens verified but user info empty
+
+**Cause:** Auth server fallback returns minimal data
+
+**Fix:**
+1. This is normal for HS256 projects using fallback
+2. `user_id` (sub) and `email` are always extracted
+3. For full token claims, migrate to RS256 signing
+
+---
+
+## Security Notes
+
+1. **Never commit secrets to Git**
+   - Use `.env.local` (gitignored) for local development
+   - Use Secret Manager for production
+
+2. **RS256 vs HS256 Security**
+   - **RS256 (recommended):** Uses public/private key pairs. Public key can't forge tokens.
+   - **HS256 (legacy):** Uses shared secret. Anyone with the secret can forge tokens.
+   - Supabase recommends RS256 for all new projects.
+
+3. **Rate limiting**
+   - Backend has rate limiting (3 requests/minute per IP)
+   - Supabase free tier: 50,000 MAUs
+
+4. **User data**
+   - User emails are logged (for audit trail)
+   - Consider privacy regulations (GDPR, CCPA)
+   - Add privacy policy if collecting user data
+
+5. **Token verification**
+   - Tokens are verified via Supabase JWKS endpoint (RS256)
+   - Fallback to Auth server verification (HS256)
+   - Never verify tokens using JWT secret directly (deprecated)
+
+---
+
+## Free Tier Limits
+
+**Supabase Free Tier:**
+- ✅ 50,000 monthly active users
+- ✅ 500 MB database storage
+- ✅ 2 GB bandwidth
+- ✅ Unlimited API requests
+- ✅ Social OAuth providers
+
+**Cost after free tier:**
+- Pro plan: $25/month (includes 100,000 MAUs)
+- Additional MAUs: $0.00325 per MAU
+
+---
+
+## Next Steps
+
+- [ ] Add email templates customization
+- [ ] Enable password reset flow
+- [ ] Add social OAuth (Google, GitHub)
+- [ ] Implement role-based access control
+- [ ] Add user profile management
+
+---
+
+## Support
+
+- **Supabase Docs:** https://supabase.com/docs
+- **Supabase Community:** https://github.com/supabase/supabase/discussions
+- **Kinemotion Issues:** https://github.com/feniix/kinemotion/issues

kinemotion-0.34.0/.basic-memory/authentication/auth-provider-comparison-december-2025.md

@@ -0,0 +1,43 @@
+---
+title: Auth Provider Comparison December 2025
+type: note
+permalink: authentication/auth-provider-comparison-december-2025-1
+tags:
+- authentication
+- comparison
+- supabase
+- clerk
+- pricing
+---
+
+## Auth Provider Comparison (December 2025)
+
+### Chosen: Supabase
+
+**Why:**
+- 50,000 MAUs free tier (vs Clerk 10K)
+- Works with `kinemotion.vercel.app` (Clerk requires custom domain)
+- $0.00325/MAU after free tier (cheapest)
+- Open source, includes Postgres
+- Excellent Python/FastAPI support
+
+### Clerk (Not Chosen)
+**Reason**: Doesn't allow `*.vercel.app` domains for production
+- Free: 10,000 MAUs
+- Paid: $25/month + $0.02/MAU
+- Best DX, fastest setup
+- Native Vercel integration
+
+### Auth0 (Not Recommended)
+**Reason**: Too expensive
+- Free: 25,000 MAUs
+- Paid: $35/month + $0.07/MAU (10K users = $700/month!)
+
+### Firebase Auth
+- Free: 50,000 MAUs
+- Cons: Google lock-in, phone auth costs extra
+
+### Cost Projection (Supabase)
+- 0-50K MAUs: $0/month
+- 100 videos/day ≈ 1-2K MAUs/month
+- **Well within free tier**

kinemotion-0.34.0/.basic-memory/authentication/auth-providers-comparison-december-2025.md

@@ -0,0 +1,13 @@
+---
+title: Auth Providers Comparison December 2025
+type: note
+permalink: authentication/auth-providers-comparison-december-2025-1
+tags:
+- authentication
+- comparison
+- supabase
+- clerk
+- auth0
+---
+
+[{"text": "# Third-Party Auth Providers Comparison (December 2025)\n\n## For Kinemotion (Vercel + Cloud Run)\n\n| Provider | Free MAUs | Vercel | Backend | Best For |\n|----------|-----------|--------|---------|----------|\n| **Clerk** | 10,000 | \u2b50 Native | \u2705 Excellent | MVP Speed |\n| **Supabase** | 50,000 | \u2705 Good | \u2705 Excellent | Long-term Cost |\n| **Auth0** | 25,000 | \u2705 Good | \u2705 Excellent | Enterprise |\n| **Firebase** | 50,000 | \u2705 Good | \u2705 Good | Google ecosystem |\n\n## Decision: Supabase (Chosen)\n\n**Why Supabase:**\n- \u2705 Most generous free tier (50K MAUs)\n- \u2705 Works with `kinemotion.vercel.app` (Clerk doesn't)\n- \u2705 Open source (can self-host)\n- \u2705 Includes Postgres database\n- \u2705 Cheapest long-term ($0.00325/MAU)\n\n## Clerk (Not Chosen - Domain Restriction)\n\n**Clerk Issue (December 2025):**\n- Does NOT allow `*.vercel.app` domains for production\n- Requires custom domain\n- Otherwise: fastest setup, best DX\n\n**Free Tier:** 10,000 MAUs\n**Paid:** $25/month + $0.02/MAU over 10K\n\n## Auth0 (Not Recommended - Expensive)\n\n**Free Tier:** 25,000 MAUs\n**Paid:** $35/month for 500 MAUs, then $0.07/MAU\n**Example:** 10K users = $700/month \ud83d\ude31\n\n## Firebase Auth\n\n**Free Tier:** 50,000 MAUs (email/password/social)\n**Cons:** Google lock-in, phone auth costs extra\n\n## Cost Projection for Kinemotion\n\n**Supabase Pricing:**\n- 0-50K MAUs: $0/month\n- 50K-100K MAUs: $25/month (Pro plan)\n- 100K+ MAUs: $25 + ($0.00325 per additional MAU)\n\n**Estimated usage:**\n- 100 videos/day \u2248 1,000-2,000 MAUs/month\n- **Cost: $0** (well within free tier)\n\n## Implementation Status\n\n\u2705 **Supabase fully integrated** (December 2025)\n- Frontend: React + @supabase/supabase-js\n- Backend: FastAPI + JWT validation\n- Deployment: Vercel + Cloud Run\n- Logging: User ID in all requests", "type": "text"}]

kinemotion-0.34.0/.basic-memory/authentication/supabase-authentication-quick-start.md

@@ -0,0 +1,88 @@
+---
+title: Supabase Authentication Quick Start
+type: note
+permalink: authentication/supabase-authentication-quick-start-1
+tags:
+- supabase
+- authentication
+- quickstart
+- implementation
+---
+
+# Supabase Authentication - Quick Start
+
+## ✅ Implementation Complete!
+
+Supabase authentication has been fully integrated with both frontend and backend.
+
+## What Was Implemented
+
+### Frontend (React + Vite)
+- ✅ Supabase client configuration (`src/lib/supabase.ts`)
+- ✅ Authentication hook (`src/hooks/useAuth.ts`)
+- ✅ Sign in/sign up component (`src/components/Auth.tsx`)
+- ✅ Updated App.tsx with auth flow
+- ✅ Auth token sent to backend in API requests
+- ✅ CSS styling for auth UI
+
+### Backend (FastAPI + Cloud Run)
+- ✅ Supabase JWT validation (`src/kinemotion_backend/auth.py`)
+- ✅ ES256/RS256 verification via JWKS endpoint (modern)
+- ✅ Automatic fallback to Auth server for HS256 projects (legacy)
+- ✅ Middleware extracts user ID from tokens (`middleware.py`)
+- ✅ User ID automatically logged in all requests
+- ✅ User email logged for audit trail
+
+## Quick Setup Steps
+
+### 1. Create Supabase Project
+- Go to [database.new](https://database.new)
+- Name: `kinemotion`, Region: closest, Plan: Free (50K MAUs)
+
+### 2. Get Credentials
+- Dashboard → Settings → API Keys
+- Copy: Project URL + Publishable key (`sb_publishable_xxx`)
+
+### 3. Configure Authentication
+- Dashboard → Authentication → URL Configuration
+- Site URL: `https://kinemotion.vercel.app`
+- Redirect URLs: `https://kinemotion.vercel.app/**`, `http://localhost:5173/**`
+
+### 4. Environment Variables
+
+**Frontend (.env.local):**
+```
+VITE_SUPABASE_URL=https://project.supabase.co
+VITE_SUPABASE_ANON_KEY=sb_publishable_xxx
+VITE_API_URL=http://localhost:8000
+```
+
+**Backend (.env):**
+```
+SUPABASE_URL=https://project.supabase.co
+SUPABASE_ANON_KEY=sb_publishable_xxx
+LOG_LEVEL=INFO
+JSON_LOGS=false
+```
+
+### 5. Production Deployment
+
+**Google Cloud Secrets:**
+```bash
+./scripts/setup-supabase-production.sh
+```
+
+**Vercel Environment Variables:**
+Add VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY, VITE_API_URL
+
+## Testing Results
+- ✅ All 85 backend tests pass
+- ✅ 0 type errors (pyright strict)
+- ✅ 0 linting errors (ruff)
+- ✅ Frontend type checking passes
+
+## Files Changed
+**Frontend:** package.json, src/lib/supabase.ts, src/hooks/useAuth.ts, src/components/Auth.tsx, src/App.tsx, src/index.css
+**Backend:** pyproject.toml, src/kinemotion_backend/auth.py, src/kinemotion_backend/middleware.py
+
+## Free Tier: 50,000 MAUs/month (well within capacity)

kinemotion-0.34.0/.basic-memory/authentication/supabase-authentication-setup-guide.md

@@ -0,0 +1,110 @@
+---
+title: Supabase Authentication Setup Guide
+type: note
+permalink: authentication/supabase-authentication-setup-guide-1
+tags:
+- supabase
+- authentication
+- setup-guide
+- production
+---
+
+# Supabase Authentication Setup Guide
+
+## Overview
+Kinemotion uses Supabase for authentication with JWT token validation, automatic user ID logging, and protected API endpoints.
+
+## Modern Approach (December 2025)
+
+**JWT Signing Keys:**
+- **Modern**: ES256/RS256 (asymmetric) - JWKS endpoint verification
+- **Legacy**: HS256 (symmetric) - Auth server fallback
+
+**Backend support:** Tries JWKS first, falls back to Auth server automatically.
+
+## Step 1: Create Supabase Project
+
+1. Go to [database.new](https://database.new)
+2. Fill in: Name (kinemotion), Password (generate), Region (us-east-1), Plan (Free)
+3. Click "Create new project"
+4. Wait ~2 minutes
+
+**Note:** New projects (July 2025+) use ES256 automatically. Legacy projects: migrate via Settings → JWT signing keys → "Migrate JWT secret".
+
+## Step 2: Get Credentials
+
+Dashboard → Settings → API Keys:
+- **Project URL**: `https://xxx.supabase.co`
+- **Publishable key**: `sb_publishable_xxx...` (safe for frontend)
+- **Secret key**: `sb_secret_xxx...` (server-side only)
+
+**Key format change (2025):** New format is `sb_publishable_xxx`, legacy is JWT-style `eyJ...`.
+
+## Step 3: Configure Authentication
+
+### URL Configuration
+- Path: Authentication → URL Configuration
+- Site URL: `https://kinemotion.vercel.app`
+- Redirect URLs: `https://kinemotion.vercel.app/**`, `http://localhost:5173/**`
+
+### Email Provider
+- Path: Authentication → Providers
+- Email is enabled by default
+
+## Step 4: Frontend Environment Variables
+
+**Development (.env.local):**
+```
+VITE_SUPABASE_URL=https://project-id.supabase.co
+VITE_SUPABASE_ANON_KEY=sb_publishable_xxx
+VITE_API_URL=http://localhost:8000
+```
+
+**Production (Vercel):**
+Add same variables via Settings → Environment Variables
+
+## Step 5: Backend Environment Variables
+
+**Development (.env):**
+```
+SUPABASE_URL=https://project-id.supabase.co
+SUPABASE_ANON_KEY=sb_publishable_xxx  # Optional, for Auth server fallback
+LOG_LEVEL=INFO
+JSON_LOGS=false
+```
+
+**Production (Cloud Run):**
+1. Create secrets in Google Secret Manager
+2. Grant IAM access to service account
+3. Update deploy-backend.yml with --set-secrets flag
+
+See full commands in detailed guide.
+
+## Testing Locally
+
+```bash
+# Backend
+cd backend && uv run uvicorn kinemotion_backend.app:app --reload
+
+# Frontend
+cd frontend && yarn dev
+```
+
+Open http://localhost:5173 → Sign up → Confirm email → Sign in → Upload video
+
+## Verification
+Logs show: `user_id`, `user_email`, `request_id` in all requests
+
+## Troubleshooting
+- Invalid token: Re-sign in (tokens expire after 1 hour)
+- JWKS failed: Normal for HS256, backend uses fallback
+- CORS error: Check CORS_ORIGINS includes Vercel domain
+
+## Security
+- ES256: Public/private keys (can't forge tokens)
+- HS256: Shared secret (anyone with it can forge) - deprecated
+- Never commit .env files
+- Use Secret Manager for production
+
+## Free Tier: 50,000 MAUs/month
+Pro: $25/month (100K MAUs), Additional: $0.00325/MAU