54 karma · joined December 18, 2024
https://github.com/kirodotdev/Kiro/issues?q=is%3Aissue%20sta...
There's been no direct explanation for the suspensions, though an AWS staff member did post this on the Kiro Discord around the same time:
"We're tuning our fraud and abuse detection systems, which has impacted some valid accounts... We've cleared the backlog of remaining cases, except for a handful that require additional investigation. Most users can expect a response within 12 hours."
Thought I would share this for anyone running a similar set up doing frontend/full-stack work. I know playwright MCP is nothing new, but the CLI + skill is much lighter on token usage. So far so good.
- Simple online verification: the easiest way is to use the public POST /v1/verify endpoint. Any of your services can call this with the agent's credential. It's a stateless check that returns a JSON object confirming if the token is valid and crucially what scopes and user_identifier it was issued for.
- Decentralized/offline verification: for more advanced use cases or high-throughput services that want to avoid a network call you can also verify the credentials offline. The tokens are standard JWTs signed with RS256, and I expose the public keys via a standard /.well-known/jwks.json endpoint on the main domain. You can fetch the keys, cache them and then verify the token signatures locally.
The goal is to make it easy for a developer to get started with the online endpoint, while still providing the standard, scalable method for more mature systems. Thanks for checking it out!