update

backend/app/main.py

@@ -114,6 +114,8 @@ app.include_router(outreach_router)
 # Create uploads directory
 UPLOAD_DIR = Path("/data/uploads")
 UPLOAD_DIR.mkdir(parents=True, exist_ok=True)
+# UniPile credentials are read fresh on each request (see _load_unipile_env) so Spaces secret
+# updates and stripping whitespace behave reliably. Module-level kept for backwards compat.
 UNIPILE_API_BASE = os.getenv("UNIPILE_API_BASE", "").rstrip("/")
 UNIPILE_API_KEY = os.getenv("UNIPILE_API_KEY", "")
 FRONTEND_ORIGIN = os.getenv("FRONTEND_ORIGIN", "").rstrip("/")
@@ -224,17 +226,26 @@ def _linkedin_public_identifier(raw: str) -> str:
     return s.split("?")[0].strip("/").strip()
 
 
+def _load_unipile_env() -> tuple[str, str]:
+    """Read UniPile DSN and API key from the environment (strip whitespace / newlines from secrets)."""
+    base = (os.getenv("UNIPILE_API_BASE") or "").strip().rstrip("/")
+    key = (os.getenv("UNIPILE_API_KEY") or "").strip()
+    return base, key
+
+
 def _require_unipile_config():
-    if not UNIPILE_API_BASE or not UNIPILE_API_KEY:
+    base, key = _load_unipile_env()
+    if not base or not key:
         raise HTTPException(
             status_code=400,
-            detail="UniPile is not configured. Set UNIPILE_API_BASE and UNIPILE_API_KEY in backend env.",
+            detail="UniPile is not configured. Set UNIPILE_API_BASE and UNIPILE_API_KEY in backend env (Hugging Face: Space → Settings → Secrets).",
         )
 
 
 def _unipile_headers():
+    _, key = _load_unipile_env()
     return {
-        "X-API-KEY": UNIPILE_API_KEY,
+        "X-API-KEY": key,
         "accept": "application/json",
         "content-type": "application/json",
     }
@@ -246,7 +257,8 @@ def _unipile_call(method: str, path: str, payload: Optional[dict] = None):
     Raises HTTPException only on transport failure (not on 4xx/5xx responses).
     """
     _require_unipile_config()
-    url = f"{UNIPILE_API_BASE}{path}"
+    base, _ = _load_unipile_env()
+    url = f"{base}{path}"
     try:
         resp = requests.request(
             method=method.upper(),
@@ -278,6 +290,14 @@ def _unipile_request(method: str, path: str, payload: Optional[dict] = None):
             )
             if isinstance(msg, (dict, list)):
                 msg = json.dumps(msg)
+            err_type = _safe_str(data.get("type"))
+            if status == 401 and err_type == "errors/missing_credentials":
+                msg = (
+                    "UniPile rejected the request (missing or invalid API credentials). "
+                    "In Hugging Face Space → Settings → Secrets, set UNIPILE_API_KEY to your UniPile API access token "
+                    "(Dashboard → API keys) and UNIPILE_API_BASE to your UniPile API URL (no trailing slash). "
+                    "Remove accidental quotes or spaces when pasting; redeploy/restart the Space after saving."
+                )
         raise HTTPException(
             status_code=status,
             detail=msg or f"UniPile error ({status}): {data if not isinstance(data, dict) else json.dumps(data)}",
@@ -1400,10 +1420,11 @@ async def create_unipile_mailbox_hosted_link(
     t.db.add(state)
     t.db.commit()
     expires_iso = expires_at.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] + "Z"
+    api_base, _ = _load_unipile_env()
     payload = {
         "type": "create",
         "providers": ["GOOGLE"],
-        "api_url": UNIPILE_API_BASE,
+        "api_url": api_base,
         "expiresOn": expires_iso,
         "notify_url": f"{origin}/api/unipile/mailbox/hosted-callback",
         "success_redirect_url": f"{origin}/settings?mailbox=connected",
@@ -1587,10 +1608,11 @@ async def create_unipile_linkedin_hosted_link(
     t.db.commit()
 
     expires_iso = expires_at.strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] + "Z"
+    api_base, _ = _load_unipile_env()
     payload = {
         "type": "create",
         "providers": ["LINKEDIN"],
-        "api_url": UNIPILE_API_BASE,
+        "api_url": api_base,
         "expiresOn": expires_iso,
         "notify_url": f"{origin}/api/unipile/linkedin/hosted-callback",
         "success_redirect_url": f"{origin}/settings?linkedin=connected",

backend/app/outreach_routes.py

@@ -95,8 +95,8 @@ def _linkedin_public_identifier(raw: str) -> str:
 
 
 def _unipile_env() -> Tuple[str, str]:
-    base = os.getenv("UNIPILE_API_BASE", "").rstrip("/")
-    key = os.getenv("UNIPILE_API_KEY", "")
+    base = (os.getenv("UNIPILE_API_BASE") or "").strip().rstrip("/")
+    key = (os.getenv("UNIPILE_API_KEY") or "").strip()
     return base, key