# Diagnosing write failures from web and mobile clients

## Symptom

Client-side code can GET but every SET, INCR, or DEL fails with a
permission error.

## Cause

The client holds the read-only token, which is the only token that
may ship in client code. It cannot write by design. If writes ever
worked from the client, someone shipped the standard token -  treat
that as a leak, not a feature.

## Confirm

Run the same write with the standard token from server side. Success
there proves the token scope is the cause.

## Fix

Move the write behind your API:

1. Client calls your API endpoint.
2. Your server validates the request, then writes to Redis with the
   standard token.
3. Optionally return the new value so the client can update its
   local state without a second read.

For counters and likes, consider an API endpoint that does the INCR
and returns the count: one round trip, no client-side Redis writes.

## Audit after a leak

If the standard token was ever in shipped client code, reset the
database password in the console to revoke it, then re-issue and
redistribute. Assume the old token is compromised.

## Verify

Client reads succeed, client writes fail closed, and all mutations
flow through your API with the standard token.