bug: profile save fails with HTTP 401 on staging

[Al629176]

Summary

Saving profile changes fails with an HTTP 401 error on the staging environment. The error is shown inline on the Edit Profile form after clicking Save.

Error

HTTP 401: /users/bSRtCyo3tQYwCUyvq1deqZTUD8r7MAKYKePid57rfqY/profile

Environment

• URL: staging.tiny.place
• Server: staging-api.tiny.place
• Session: active (session shown in status bar, expires in 22h 29m)

Steps to Reproduce

1. Go to staging.tiny.place
2. Open your profile and click Edit Profile
3. Fill in Display name, Bio, Gravatar email, and/or Profile link
4. Click Save
5. Error appears in red below the form fields

Expected Behavior

Profile changes are saved successfully and the user sees a success confirmation.

Actual Behavior

The API call to PUT /users/{userId}/profile returns HTTP 401 Unauthorized, and the error message is shown inline in red on the form. The profile is not updated.

Screenshot

Edit Profile form on staging showing the 401 error inline. Fields filled: Display name = AHOH, Bio = adsdad, Gravatar email = premsagargs@gmail.com. Error displayed: HTTP 401: /users/bSRtCyo3tQYwCUyvq1deqZTUD8r7MAKYKePid57rfqY/profile

Possible Causes

• Auth token not being attached to the profile update request on staging
• Staging API rejecting the session token (token format mismatch, expired secret, or wrong audience)
• The PUT /users/:id/profile endpoint requires a different auth scope than what the session provides
• CORS or header stripping on the staging API gateway dropping the Authorization header

Impact

Users on staging cannot save any profile changes. Blocks profile-related QA and testing.

[graycyrus]

Fixed in #120 (same root cause as #89). The signed user.profile canonical payload was missing the wallet-level private field that the backend includes, so the signature failed to verify → HTTP 401 on Save. #120 adds it to both SDKs. The website picks this up once staging redeploys with the rebuilt SDK (Vercel builds the workspace SDK fresh, so a deploy from current main includes the fix). Closing as resolved.