Explicit route set, not prefix. Each location is tagged with l402_realm "name", so membership is opt in and a new route under the same tree doesn't silently join.
Your instinct still lands though, it just moves: nothing enforces uniform pricing inside a realm, so two locations sharing a name at different prices means the cheap token opens the dear route. That's documented, but documentation isn't a guard. Filing it, likely as a startup warning rather than a hard reject, since nginx merges each location independently and a reject would break anyone already running mixed prices.
On bearer tokens, the preimage is single use by default, claimed atomically with SET NX EX, so that's the spend counter. Realm mode requires l402_indefinite_access which turns that off by design, and there your point is exact: ExpiresAt is the only bound.
The idempotency hit is fair and unanswered today. Pay, lose the response, retry, preimage already claimed, 401 having paid for nothing. Filing it as a discussion rather than a task though, because a retry window is a replay window: anyone positioned to observe the preimage gets the same grace. Curious how you scoped the request id, is it bound to the payer or just to the request?
DhananjayPurohit / Dhananjay Purohit
npub1qn…d9r6h
2026-08-18 18:18:44 UTC
in reply to nevent1q…z69a
Author Public Key
npub1qnw27f2jsqvn05wzpd56m7ykgmepk57p0yrzw8fzc7lfhjkmjmqqmd9r6hSeen on
wss://relay.ditto.pubPublished at
2026-08-18 18:18:44 UTCEvent JSON
{
"id": "edbc50822d905410e907538555b8378381628b51f3813615b778dd2b4bca02ce",
"pubkey": "04dcaf2552801937d1c20b69adf89646f21b53c17906271d22c7be9bcadb96c0",
"created_at": 1787077124,
"kind": 1,
"tags": [
[
"p",
"04dcaf2552801937d1c20b69adf89646f21b53c17906271d22c7be9bcadb96c0"
],
[
"p",
"bb5058aa4c762326b2c02390063f99ace7a7e4c34955d810fb5f44b8de48f355"
],
[
"e",
"fdc0f204f77d7efa123694e34e3e7f6b97cbb1b4442c8379666d422c20e7db55",
"",
"root",
"bb5058aa4c762326b2c02390063f99ace7a7e4c34955d810fb5f44b8de48f355"
],
[
"client",
"Primal Android"
]
],
"content": "Explicit route set, not prefix. Each location is tagged with l402_realm \"name\", so membership is opt in and a new route under the same tree doesn't silently join.\n\nYour instinct still lands though, it just moves: nothing enforces uniform pricing inside a realm, so two locations sharing a name at different prices means the cheap token opens the dear route. That's documented, but documentation isn't a guard. Filing it, likely as a startup warning rather than a hard reject, since nginx merges each location independently and a reject would break anyone already running mixed prices.\n\nOn bearer tokens, the preimage is single use by default, claimed atomically with SET NX EX, so that's the spend counter. Realm mode requires l402_indefinite_access which turns that off by design, and there your point is exact: ExpiresAt is the only bound.\n\nThe idempotency hit is fair and unanswered today. Pay, lose the response, retry, preimage already claimed, 401 having paid for nothing. Filing it as a discussion rather than a task though, because a retry window is a replay window: anyone positioned to observe the preimage gets the same grace. Curious how you scoped the request id, is it bound to the payer or just to the request? \n\n",
"sig": "2d2d40458a76143bbb0774398921c103146b8521e4a2154a2c3f382b2be08e4a6c8303708d5b1d541ca4a9719e8d67211040062e2d19ac140afd226f9b13848d"
}