Debugging

Part of the Refresh Token Design series. Two Correct Features Branching says a refresh that cannot prove its device gets a new row of its own, copying the device key from the row it came from, opening at the lowest tier. The honest case is a browser whose storage was cleared, and its road back is to prove a second factor, which rebinds the row to a fresh key. Per request signing says every request carrying a session must be signed by the device key on that session’s row. ...

Part of the PurelyManage series. PurelyMail has an API. It is not publicly documented. There are no official client libraries. There is no changelog. What exists is a community-written reference at news.purelymail.com/api/index.html that covers the basic endpoints but leaves field names, response shapes, and edge cases as exercises for the reader. Building PurelyManage meant figuring out every endpoint through trial, error, and reading raw JSON responses carefully. Some of it was quick. Some of it was not. ...