# Diagnosing write failures from web and mobile clients
## Symptom
Client-side code can GET but every SET, INCR, or DEL fails with a
permission error.
## Cause
The client holds the read-only token, which is the only token that
may ship in client code. It cannot write by design. If writes ever
worked from the client, someone shipped the standard token - treat
that as a leak, not a feature.
## Confirm
Run the same write with the standard token from server side. Success
there proves the token scope is the cause.
## Fix
Move the write behind your API:
1. Client calls your API endpoint.
2. Your server validates the request, then writes to Redis with the
standard token.
3. Optionally return the new value so the client can update its
local state without a second read.
For counters and likes, consider an API endpoint that does the INCR
and returns the count: one round trip, no client-side Redis writes.
## Audit after a leak
If the standard token was ever in shipped client code, reset the
database password in the console to revoke it, then re-issue and
redistribute. Assume the old token is compromised.
## Verify
Client reads succeed, client writes fail closed, and all mutations
flow through your API with the standard token.