The phone's session header signs in a READ, so KamoMobile can open help, scripts and tasks

Shipped

November 6, 2026 at 10:06 PM UTC

Author

Kamo

Commit

a2f35b6

KamoMobile calls api.<org> with X-***-Token and cannot mint an OTK, so every KBService read it made (the Password Vault's help article, sales scripts, task lists) answered 401. The header now authenticates GET/HEAD only; a write still needs a single-use OTK. TPVAULTMOBILE.