Incident Update: Delayed Bulk Processing Jobs

FreeOCR.AI uses database webhooks to start background workers after a bulk job is created. During this incident, an upstream API gateway rejected valid service authentication before those requests reached our workers. Jobs were recorded correctly, but some workers never received the signal to begin processing.

Supabase has reported a related ongoing API Gateway incident involving JWT rejections on its official status page. We changed our internal authentication flow so FreeOCR.AI no longer depends on the affected gateway check for these webhook calls.

The earliest affected FreeOCR.AI job we found was created late on August 17. The issue continued into August 21 and affected asynchronous bulk OCR, bulk table extraction, and bulk data extraction. Individual users may have seen jobs remain in Processing much longer than expected.

The incident did not prevent jobs from being saved. After the fix was deployed, we replayed the queued jobs. Some completed successfully; jobs that could not complete moved to Failed and entered the normal credit refund flow.

We moved service-to-service authentication into the Edge Functions themselves, redeployed all three affected workers, and replayed the waiting queue. We then checked all three job tables and confirmed that the previously stuck Processing queue had been cleared.

We are also adding clearer alerts for webhook authentication failures and long-running Processing jobs, along with a safer recovery path for replaying work when an upstream service has an incident.

Please check your History and credit balance. If a result is missing, a task still looks wrong, or you believe credits were not returned correctly, email us and include the email address used for your FreeOCR.AI account. An approximate job time or batch name will also help us find the relevant records faster.

We will investigate the account and task records. If we confirm that this incident caused a loss, we will restore the affected credits or provide an appropriate remedy. Never send us your password, API key, or other secret credentials.