From f66a4e2d53451790645512d07182cdc9ec5fd333 Mon Sep 17 00:00:00 2001
From: Hermes <hermes@niklashmotion.art>
Date: Fri, 4 Sep 2026 15:01:01 +0000
Subject: [PATCH] fix: treat 401/403 from exchange as invalid-ticket
 (single-use UX)

---
 backend/routes/auth.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/backend/routes/auth.js b/backend/routes/auth.js
index aa315e4..d9ef54e 100644
--- a/backend/routes/auth.js
+++ b/backend/routes/auth.js
@@ -236,8 +236,9 @@ async function redeemTicket(ticket) {
   } finally {
     clearTimeout(timer);
   }
-  if (resp.status === 404) {
-    // Ticket unknown or already redeemed (single-use)
+  if (resp.status === 404 || resp.status === 401 || resp.status === 403) {
+    // Ticket unknown / already redeemed (single-use) or bad server-to-server
+    // credentials — indistinguishable from the client's perspective.
     throw Object.assign(new Error('Invalid or expired ticket'), { status: 401 });
   }
   if (!resp.ok) {