Signing in. Most websites/apps will probably also grab your unread count, and maybe even your subscription feeds.
Another example is checking your inbox. Lemmy actually has 3 inboxes: mentions, replies and PMs. A lot of websites/apps bundle these three so they will need to check all 3 inboxes via 3 API calls.
Different token each time
It’s based on my understanding of how servers work and my tests. There is obviously always room for error, but I’m like 99% confident I’m right.
Also AFAIK lemmy doesn’t kick you out because you signed in elsewhere.
The good news is it only appears to affect lemmy.world. If you have an account on another instance, you should switch to that account for now.
No. This issue goes a lot deeper than your login information.
The issue is server sided so it will not matter what you use unfortunately. Technically a temp but terrible fix is to keep retrying on 400s (not signed in) until a 200 (success) is returned. This is terrible because you pretty much never want to retry for 400 errors because 400 errors are client side errors (except in this case).
Login in likely always succeeding. The issue is that whatever app/website you use will make additional API calls afterwards (eg. fetch posts or fetch unread count). Each of those calls have a 1-in-2 chance to succeed and if any of them fail, they all fail and you will be booted out.
Lemmy is now an RNG game. We must prayge to rngesus before making any actions.
From my tests, it’s almost perfectly a 50/50 whether any API requests you make will yield a 200 (success) or a 400 (not signed in). If you perform an action that takes 3 API requests, your chances of succeeding is (1/2)^3 or 1/8 because only 1 request needs to fail in the chain for the entire action to fail. So, as long as you make single API actions you can maximize your success rate :D
From my experience it’s entirely random. You can make 5 actions and all 5 will work. Then have a string of 5 actions where none would work.