zoo.exchange/config.json shipped "iamHost":"https://iam.zoo.network" to every
browser. That host has no ingress, no Traefik router and no IAM_ISSUER_MAP
entry anywhere; its DNS A record pointed at the lux-k8s LB, which answered the
handshake with CN=INGRESS DEFAULT CERT. So every IAM call from the Zoo Exchange
SPA — mainnet and testnet — died before the first byte of HTTP. A client written
against a route that never existed.
zoolabs.id is Zoo's identity origin and already serves both halves: the login
SPA at / and the IAM API at /v1/iam, /oauth, /.well-known (routers
zoolabs-id + zoolabs-id-iam-api in the hanzoai/ingress file provider). Its
discovery doc reports issuer=https://zoolabs.id with a reachable 9-key JWKS, so
fetching discovery from that origin is self-consistent — which is what a strict
OIDC client checks. SPA_ID_HOST was already zoolabs.id.
There is no iam.<brand> host in the design. iam.hanzo.ai is the one legacy IAM
host, kept because the shared Google/GitHub OAuth clients register exactly one
callback against it; every brand otherwise reaches IAM through its own id
origin. iam.zoo.network / iam.pars.network are being retired to NXDOMAIN, and
the orphaned hanzo/iam-multi Ingress that claimed them is deleted.
Co-authored-by: Hanzo Dev <[email protected]>
zeekayandHanzo Dev
da042e74bf