Where to report service interuptions

[TD-4242]

We started getting this message a bit after midnight last night (10 hours prior to this message) and no notifications.

{"message":"Channel denied access based on given capability; channelId = project:4804:user:7b8a3347-9601-4195-bbef-1de7b93ebf4c. (See https://help.ably.io/error/40160 for help.)","code":40160,"statusCode":401,"nonfatal":false,"href":"https://help.ably.io/error/40160"}

[unamashana]

Hey There!

I believe we received your email too, but for anyone else reading, we are always available at hello@ our domain. Onto the issue, for which, I am very sorry.

It looks like the upgrade deployed to our Auth service is affecting your API call. You are sending API secret for a user-auth call (you are also sending X-MagicBell-User-External-ID). Please change the headers to add a HMAC key and remove the secret key - https://www.magicbell.com/docs/channels/notification-inbox/hmac-authentication

I am very sorry we missed this in our testing. We never official supported this configuration, and we can try to work around it, but it will take us some time to get the patch out.

[TD-4242]

Looking at all the api requests we are using the X-Magicbell-User-Hmac header for all calls. the clients don't have any access to the API secret. we initialize the client with the react sdk:

       <MagicBellProvider
          apiKey={MAGICBELL_API_KEY}
          userExternalId={userId}
          userEmail={email}
          userKey={hmacId}
          stores={[ ... ]}>
          <div className="notifications-container">
            <NotificationsButton initialActiveChartId={initialActiveChartId} type="v2" />
          </div>
        </MagicBellProvider>

[sakopov]

We're also seeing a strange behavior. Our API calls to Magicbell started returning HTTP/500. We reached out to support and were told that we needed to switch to HMAC auth. We switched our calls to use HMAC and our API calls to Magicbell started working even without turning on HMAC authentication in the workspace. When we tried turning HMAC on, these calls started returning HTTP/500 again. So it appears that the HMAC switch somehow works in reverse. Also, when we tried to turn HMAC off, we get "Missing KID" error and the save doesn't work. All-in-all, looks like half of the API is inaccessible now.

[unamashana]

The missing KID error has been fixed. We've tested the hmac implementation since your bug report (we have automated tests for this too), and the hmac verification is working as expected. Please feel free to reply to my last email follow up if you are continuing to see this issue. Thanks!