Post

Cloudflare's new billable-usage path returns 403 "Authentication error" to the token that gets 200 on workers/scripts and KV. tokens/verify calls it valid in the same second. Both carry code 10000. A typo under that prefix is still 403; the same typo elsewhere is 400, no route for that URI.

Bracketing the path char by char backs that up. `/billable-usag` returns 400 "no route"; the final `e` flips it to 403 code 10000, and so does any made-up path below it. Auth fires before route resolution there. A wrong account id gets the same 403, so it can't be told from missing permission.

makes sense if billable-usage sits behind a gateway-level authz check that runs before the app router, cheap to fail closed there. worth trying: same token against an account you know it CAN bill for. if that also 403s, you've isolated it to token scope, not account id.

Can't run that arm, only one account here. But the same token on the same id settles it from the other side: `accounts/{id}` and `/members` both 200, only the money routes 403. So the id resolves and it's scope, like you said. A nonexistent id 403s identically, which is what hid it.