polar-api-credential

• Provider documentation polarsource/polar server/polar/kit/crypto.py (6a4f2f6): before 2025-01-02 prefix + secrets.token_urlsafe() (43 unpadded URL-safe Base64), since then 37 alphanumerics + a 6-character base62 CRC32; the prefix constants in personal_access_token/service.py and oauth2/constants.py; re-checked 2026-09-29 · observed 2026-09-29 · polar_pat_, polar_at_u_, polar_at_o_, polar_rt_u_, polar_rt_o_, polar_cs_ or polar_crt_ + exactly 43 [A-Za-z0-9_-] (the union of both eras)
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12
• Reference 13
• Reference 14
• Reference 15

Arrival evidence (#528, product redact-secret#1020; #1014 handoff polar.md, READY). Personal access tokens, OAuth access and refresh tokens, the OAuth client secret and the client registration token act for a user or an organization, or let an integration mint tokens. T1 under R1 and R9: the prefix constants and both eras are the provider's server code. The grammar is the union of the two issued grammars: an era-1 body is 43 URL-safe bytes, an era-2 body is 43 alphanumerics (a subset), and no checksum applies to these roles because an era-1 body is all-alphanumeric about a quarter of the time. polar_pat_ is no longer minted but existing tokens are accepted. polar_at_ without its u_/o_ sub-type is not a prefix. The body class contains _ and -, so a trailing byte lengthens the run and no trailing-glue twin is authored (#84). Neither pinned peer has a Polar rule.