this was such a funny read

Mistral is playing the long game here ngl, lower sized models, lower costs, overall good enough performance!

The songs it generates is so corporate music pilled and generic, it has no creativity of its own and even if we try to make it do something creative, it generates the same EDM style beat with no taste, well I guess stock music users rejoice, you dont need to use stock music anymore, you can create endless stock music

Omg, we can access even ancient OSes, this is amazing!

kdenlive is really good

but api keys arent meant to be revoked once used right?

Yes, it's just a random long password used to access public APIs

no this is just a POC, I haven't implemented any of it

Ok, then for everyone. Don't save tokens in a database. Selects are vulnerable to timing attacks. You want a token to include a id and a signature. The ID is used to look up the scope or user attached to the token, while the signature is recreated from the ID, the server secret and some salt. The resulting signature is double checked with the provided signature with a time constant comparison.

An attacker will be able to identify valid keys, but won't be able to sign them.

You can either split the values like aws or join them with a separator.

Good idea with the slug though, makes it easier to report leaked tokens to the issuer.

fixed it in the blog, thanks for pointing it out amelius ;-;

It is alright, I am learning a lot from them as well, healthy criticism is always useful :) I am very glad that you found this a great write up ^_^