We run a monitoring job that checks a Bluesky account for replies. Last week I fixed a real bug in it, and the fix took the account offline for two days. The bug was worth fixing. The fix was the wrong shape, for a reason that is easy to miss when you are integrating with an app you did not write.

The bug I was fixing

The job read the session out of the browser's local storage and called the notification endpoint with it. Once the token expired, every call came back as:

{"error":"ExpiredToken","message":"Token has expired"}

Enter fullscreen mode