···150150 const proxyUrl = new URL(request.url);
151151 proxyUrl.host = 'api.rocksky.app';
152152 proxyUrl.hostname = 'api.rocksky.app';
153153- const apiRes = await fetch(proxyUrl, request);
154154- return withCors(apiRes, origin);
153153+ // Bypass the Cloudflare edge cache for API-proxied routes (OAuth
154154+ // callbacks, tokens, dynamic data) so a stale response — e.g. a 404
155155+ // from before a deploy — is never served.
156156+ const apiRes = await fetch(new Request(proxyUrl, request), { cf: { cacheTtl: 0, cacheEverything: false } });
157157+ const res = withCors(apiRes, origin);
158158+ // Also tell the browser/intermediaries not to store the response.
159159+ res.headers.set('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0');
160160+ res.headers.delete('Expires');
161161+ res.headers.delete('ETag');
162162+ return res;
155163 }
156164157165 // check header if from mobile device, android or ios