How Trailing Newlines in Environment Variables Silently Broke Our S3 Auth

If you've ever spent hours debugging a production auth failure that works perfectly in local dev, this one's for you. The Symptom Our video player worked flawlessly locally but showed an infinite loading spinner in production. No error messages. No 4xx/5xx in the logs. Just... silence. After checking every obvious thing (CORS, CSP, Clerk auth, Supabase RLS), we finally spotted the real culprit in the raw HTTP request headers. The Root Cause: ` ` in the Authorization Header We'd set our Cloudflare R2 credentials on Vercel using a shell pipe like this: echo " $R2_SECRET_ACCESS_KEY " | vercel env add R2_SECRET_ACCESS_KEY production The problem? echo appends a trailing newline by default. Vercel stored mysecretkey — including the — as the env var value. When the AWS S3 SDK built the Authorization header, it included that newline character in the HMAC signature string. The result was an invalid HTTP header that R2 rejected silently (no meaningful error message from the S3 client — it just f