# Security and troubleshooting

## Authorization boundaries

Connections belong to the account that approved them. Tokens contain explicit scopes, expire, are stored as hashes and can be revoked. Workspace operations independently check the account's current active owner membership and workspace status. Removing ownership or suspending a workspace immediately prevents delegated use.

Account operations cannot change roles, verified status or admin-configured limits. Profile and billing email changes retain verification requirements. Source blocking is global and does not depend on a user-provided display name. Source registration does not imply trust in the content an agent reads.

## Protect credentials

Keep API keys and OAuth access/refresh tokens in a secure server-side secret store. Do not paste authorization URLs containing codes or login tokens into issues or screenshots. Do not send one environment's tokens to another environment. Prefer the minimum required permissions and revoke unused connections.

## Product import errors

Long Turkish names and descriptions are supported. Product slug creation uses literal range comparisons rather than LIKE/GLOB patterns, avoiding D1's 50-byte pattern limit. Slug collisions receive suffixes; simultaneous duplicates are rejected by database constraints and reported safely.

Other text-search and collection-slug paths currently retain LIKE queries and can encounter the D1 pattern limit for long patterns. Use shorter search text until those separate paths are revised. This does not require shortening stored product names or descriptions.

## OAuth connection failures

- Verify the MCP endpoint matches the intended environment.
- Use a client supporting Streamable HTTP, OAuth discovery and S256 PKCE.
- Check registered callback URL, exact resource/audience and requested scopes.
- Signed CIMD clients must publish reachable metadata/JWKS on validated public HTTPS endpoints and send correctly signed, unique assertions.
- Reconnect if the authorization expired, a code was reused, a grant was revoked or a refresh token was replayed.
- Ask an administrator whether the source is globally blocked.
- Earlier workspace-only connections must reconnect for account consent.

## Contact and limits

If the workspace creation limit is reached, use Contact us. A previous unread contact request prevents another submission until an administrator marks it as read. Administrators can adjust the account's limit after review. Repeated create calls cannot bypass the limit.

Unexpected database failures produce a safe user-facing error. Preserve the operation name, time, environment and safe error text when contacting support. Do not include private tokens or full authorization URLs.