LuaDashboard links
Use /dashboard/overview, /dashboard/scripts, or /dashboard/keys. Old bookmarks such as /dashboard#keys are converted without dropping query parameters.
API clients
The auth API uses a ticket exchange: a successful first response contains a ticket, not source. Repeat the same access fields with that ticket to request delivery, and keep the payload decoder and digest check. Review the full contract.
Failure statuses
Denied access uses HTTP 403 (not 200). Keep reading the JSON code/message. 400 = malformed input, 429 = rate limits, 503 = configuration/storage failures.
Existing databases
Apply supabase/migrations/20261005_loader_tickets.sql before using shared sessions. All replicas must use the same database. A missing ticket table yields SESSION_STORAGE.
Existing snippets
Keep the same script file IDs and loader URLs. The server supplies the protected universal bootstrap; buyers do not need a new artifact per script.