Original Summary

I added an Alexa skill to my to-do app (Tasqs) so I could ask "Alexa, what's due today?" and hear my list back. The actual voice logic took an afternoon (or so). Getting Alexa to reach my server at all took two weeks and broke at six separate layers, each hiding the next. Writing it up because I'd have killed for this list when I started. The setup: my app sits behind Cloudflare, and Alexa links to a user's account over OAuth. So a voice request has to survive Amazon's signature checks, my OAuth server, Cloudflare, and my origin before it ever runs a query. Every one of those had a problem. 1. The SSL cert. Alexa's account-linking rejects Let's Encrypt certs (which is what my edge was serving). Spent a day convinced my cert chain was broken before realizing it was valid, just from a CA Amazon doesn't accept. Had to switch to a different certificate authority. 2. The client secret silently went blank. Amazon's console never re-displays a saved OAuth secret, and it happily saved an empty one during an unrelated edit. Result: token exchange failing with "invalid client" while the console looked correct. 3. My OAuth client row got deleted. From working in the database during the cert mess. Now the authorize step threw "Unknown application." Wrote a little script to recreate it that pins the original ID so I only ever have to re-paste the secret. (This one was my fault!) 4. Placeholder redirect URLs. I'd saved the literal string "YOUR_VENDOR_ID" as a redirect URI (the match is exact), so every attempt bounced with "Invalid return address." Had to register all three of Amazon's real redirect URLs verbatim. 5. A silent length cap in my own code. My login-redirect helper truncated anything over 500 characters as a safety measure. Alexa's linking URL is ~1,300 characters. So linking worked perfectly if you were already logged in , and silently lost its way if you weren't. Intermittent bugs are the worst bugs. 6. The one that broke my brain: Cloudflare's Bot Fight Mode. Amazon's server-to-server token call was getting challenged at the edge as "suspicious bot traffic" (which, fair, it's a datacenter making an automated POST). The request never reached my server, so it appeared in zero logs on my end. I only cracked it by noticing my auth codes were being generated but never consumed, which proved the exchange was never arriving. The fix was a Cloudflare setting. My actual code was fine. The lesson that stuck: when something works in a browser but fails for a machine-to-machine caller, your logs are lying to you by omission. The request dying at the edge looks identical to a request that was never made. I burned days looking at my origin when the answer was in Cloudflare's security event log the whole time. And all that was just to make it work . Naming it (the Invocation Name ) was its own saga. "Tasqs" is a deliberate respe

  • 情报分类：服务器与云资源
  • 分类依据：内容涉及服务器、云资源或网络线路
  • 信息来源：Reddit · SideProject
  • 发布时间：2026/9/15 03:56:44