Security fix
The server previously granted its own configured twitterapi.io key to any request whose user-agent header contained mcpize. That header is set by the caller, so the check could be forged by anyone, allowing unauthenticated use of the operator's API credits.
Fixed: authentication now requires either a BYOK key (x-twitterapi-key) or the shared worker secret (x-worker-secret / X-MCP-Worker-Secret), compared in constant time. Requests with neither now fail closed with 401.
Impact: only affects self-hosted deployments that configured TWITTERAPI_KEY. BYOK users were never exposed — the key never leaves the server. No credential disclosure occurred; the risk was credit consumption.
Action required: if you route through a gateway, make sure it sends X-MCP-Worker-Secret. The user-agent path no longer works.