fix: don't try to mint a key for a brand-new AI/ML API account - #6
Merged
Conversation
A freshly created passwordless account is inactive (isActive: false) until its first top-up — POST /v1/keys requires USER_SCOPE.active and returns 403 for it, so the sign-up branch's key mint could never succeed. Register the account (still useful — it exists for the user's next visit) but stop there with a clear message pointing at https://aimlapi.com/app to add credit, then /login again to sign in through the code-verification path, which does mint successfully.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A freshly created passwordless account on AI/ML API is inactive (`isActive: false`) until its first top-up — confirmed live against production: `POST /v1/keys` with a brand-new account's session token returns `403 Forbidden` (`USER_SCOPE.active` required). So the sign-up branch's key mint could never succeed — it was dead on arrival for every genuinely new user.
Register the account (still useful — it exists for the user's next visit) but stop there with a clear message pointing at https://aimlapi.com/app to add credit, then `/login` again to sign in through the code-verification path, which does mint successfully (verified: existing-account sign-in reaches `POST /v1/keys` with an active session and succeeds).
Test plan