No other regions or services were disrupted, including ad-serving and APIs access across al regions.
We have been undergoing routine security hardening to comply with current industry standards. Part of this effort was to move to a model of authentication where we use shorter-lived auth tokens in conjunction with refresh tokens to seamlessly expire and update the tokens that users use upon each request to our servers via their web browsers. This change finally made its way to production on 2025-07-29 at approximately 4:58PM
The changes described above were phased across our deployment environments ensuring months of testing and validation.
Ultimately, a misconfiguration in our authentication provider’s platform meant that effectively all users of the production North-American platform were not considered in an authentication requests. More specifically, the database of users was not linked to the new authentication mechanism deployed to our environment in North-America. This resulted in all users failing to validate their sessions, and subsequently, or initially, login to the platform.