The real cause: the CORS preflight rejected our own auth header

NIP-98 puts the claim under an Authorization header, but the registrar
only allowed content-type in access-control-allow-headers, so browsers
blocked every claim before sending it. The failure arrived as a generic
network error, which the retry logic treated as transient — hence the
endless 'setting up your payment address' spinner. Bun tests never saw
it because they don't preflight.

Registrar now allows the header. Client-side, nothing may hang: signing,
the registrar call and the ark lookup all have timeouts, retries are
capped, and a one-minute watchdog always resolves the spinner into
either an address or the manual form.

Co-Authored-By: Claude Fable 5 <[email protected]>

1 files changed, 1 insertions, 1 deletions

diff --git a/names/server.js b/names/server.js
index bd693b2..8f1971a 100644
--- a/names/server.js
+++ b/names/server.js
@@ -247,7 +247,7 @@ const json = (body, status = 200) => new Response(JSON.stringify(body), {
   headers: {
     'content-type': 'application/json',
     'access-control-allow-origin': '*',
-    'access-control-allow-headers': 'content-type',
+    'access-control-allow-headers': 'content-type,authorization',
     'access-control-allow-methods': 'GET,POST,DELETE,OPTIONS',
   },
 });