PocketBill Blog
PocketBill's promise is that it never asks who you are — no account, no sign-in, offline by default. So it was ironic that my weekend went to debugging an authentication failure on a deploy script: a credential that was correct but unused, and a proxy that the one request that needed it deliberately bypassed.
PocketBill's whole promise is that it never asks you anything. No account, no sign-in, no server to reach before the screen will load — you open it on a plane and your subscriptions, bills and spending are simply there, because they have only ever lived on the phone. Nothing to authenticate against. That was the point.
Which makes the most ironic thing I did this month the two days I spent fixing a login — not PocketBill's, but a deploy script's. The contrast turned out to be the whole lesson.
The error was Failed to authenticate, have you run firebase login? I had not run it, deliberately. I had pointed GOOGLE_APPLICATION_CREDENTIALS at a service account key and exported HTTPS_PROXY, because this machine cannot reach Google without one. And the key was fine — the tool had read the file, parsed the account, and resolved its name correctly.
What it could not do was reach the token endpoint. Buried in the tool's internals was a small function that builds its own HTTP agent for those calls, and that agent ignores proxy environment variables completely. So the credential was right, the proxy was right, and the single request that needed both was the one not using them. Authentication failed almost never means the password was wrong. It means some request never finished.
Underneath that sat a second, quieter problem. The tool can read two sources of identity: the service account I had handed it, and a login session cached in a config file from months earlier. It preferred the older one. My configuration was correct and simply never used.
Clearing the stale session and unsetting the token variable took a minute. Finding it took the weekend, because both failures print the same sentence — and that sentence points at neither of them. When a tool reads two config sources, the file you edited is not necessarily the file it opens.
I could have stopped at deploy works now and moved on. But this is precisely the class of problem PocketBill exists to delete. It will show me the 9.99 dollar charge I had forgotten about; it will not show me a sign-in prompt, because there is nothing to sign into.
Local-first is not a polite way of saying we haven't built a backend yet. It is a promise that no request is required for the thing to work — and every weekend I lose to a network hop is a weekend I get back by never shipping one to my users.