Repository navigation
S8.7 — Make a missing 1Click credential legible and prove one in one command #159
Description
The S8.4 blocker is the 1Click partner JWT. Re-measured live on 2026-11-10:
- a dry
POST /v0/quoteanswers 200 with no credential; - the non-dry quote that carries
depositAddressanswers400 {"message":"Internal server error"}without one, and401 Invalid tokenwith a bogus one; /v0/tokensanswers either way; the vendor docs say unauthenticated quotes pay +25 bps but an address needs a partner credential.
Two consequences this task fixes:
- The app mapped that 400 to
upstream_rejected("1Click rejected the request"), blaming the caller's body. A non-dry quote on a deployment with noONECLICK_JWTnow fails closed withserver_misconfiguredbefore the upstream call; dry previews stay open. - There was no way to prove a token the moment it arrived.
pnpm oneclick:checkdoes a dry preview;--real <near-account>asks for a deposit address once (10.5 USDC on NEAR into itself, no deposit, expires on its own).
Docs corrected: README, ARCHITECTURE §3.2, DEPLOY env table + an "Obtaining the 1Click credential" section, LAUNCH §1.
Test: route test with a fake client whose hasJwt is false — 500 server_misconfigured, zero upstream quote calls, preview still 200.
Landing note: merged via PR (issues stay open as the roadmap).
Activity
MFrancis-dev commentedon Nov 10, 2026
Landed as #160 (
0bcb949), merged with all CI green andmergeStateStatus: CLEAN. This issue stays open because the credential itself is still human-only.What changed
ONECLICK_JWTnow answers500 server_misconfiguredwith a sentence that names the deployment, instead of forwarding the vendor's400 Internal server erroras if the client's request were wrong. Dry previews and demo mode are untouched (two route tests pin both).pnpm oneclick:checkreports the state in one command and never prints the token. With a token:pnpm oneclick:checkprints status, base units, fee, signature verdict and deposit-address presence for a realEXACT_OUTPUT10.5 USDC→USDC quote;--real <near-account>validates the address and proves the address-issuing path without moving funds.Measured 2026-11-10 (re-check of the earlier record): a dry
POST /v0/quoteanswers 200 unauthenticated; the non-dry quote that carriesdepositAddressanswers400 {"message":"Internal server error"}without a credential and401 Invalid tokenwith a bogus bearer;/v0/tokensanswers either way.Still 👤: the partner portal signs in through WorkOS (email/SSO), so the key has to be copied by a person — steps are in
DEPLOY.md"Obtaining the 1Click credential". After that:.env.local→pnpm oneclick:check --real <near-account>→vercel env add ONECLICK_JWT production→ redeploy, and S8.4 (#72) still needs a funded signer, a two-process host and a seller payout address.