Polar tokens

• Provider documentation polarsource/polar server/polar/kit/crypto.py (6a4f2f6; current since 80fae7f, 2025-01-02): 37 characters of ascii_letters + digits, then the CRC32 of those 37 bytes in base62 (0-9A-Za-z digit order) zero-padded to 6; organization_access_token/service.py (polar_oat_, added 2025-02-05 in 4639cb7, after the checksum era began); re-checked 2026-09-29 · observed 2026-09-29 · polar_oat_ + exactly 43 [A-Za-z0-9] (37 random + 6 checksum), 53 in all; one era
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10
• Reference 11
• Reference 12
• Reference 13
• Reference 14
• Reference 15

Arrival evidence (#528, product redact-secret#1020; #1014 handoff polar.md, READY). An organization access token acts on the organization's products, checkouts, customers, subscriptions and orders within its scopes. T1 under R1 and R9: the prefix constant, the 43-byte alphanumeric body and its CRC32 base62 checksum are the provider's server code, and the service was added after the checksum era began, so there is one era. POLICY, not T1: the checksum corroborates only; a shape-valid body whose last six bytes are not the checksum is still claimed (ruling Q1 is open and the security-first standing decision applies), so positives are authored both with a matching and with a mismatching checksum and no fixture asserts silence on a checksum failure. Excluded: polar_ci_ (public client id), checkout client secrets, short-lived session and verification tokens, and whsec_ webhook secrets (stripe-token owns the prefix). Neither pinned peer has a Polar rule. Graduated to a registry detector at the 4fb7882 re-pin (redact-secret PR #1039).