- Shipped
- March 30, 2026 at 4:00 AM UTC
- Author
- Kamo
- Commit
- ee7ab09
The static URL construction from the session hash was returning 404/500 because Avatar Creator SVGs aren't always stored at the expected MinIO path. Now the sidecar fetches the avatar URL from the SecurityService API (GET /api/security/members/{id}) — the same endpoint kamo-internal uses. This returns the actual accessible URL that the backend constructs, handling Avatar Creator/photo avatars correctly including presigned URLs. The sidecar generates a temporary OTK from the *** to authenticate the API call. Falls back to hash-based URL construction on failure.