movies: auto-detect v3/v4 credential + source field

app/main.py

@@ -370,7 +370,8 @@ def movies_now_playing(request: Request = None):
     if request is not None:
         _limit(request, "mov", rate=60)
     import movies_tmdb
-    return {"live": movies_tmdb.is_live(), "movies": movies_tmdb.now_playing()}
+    movies, source = movies_tmdb.now_playing()
+    return {"live": movies_tmdb.is_live(), "source": source, "movies": movies}
 
 
 @app.post("/voice", dependencies=[Depends(require_app_key)])

app/movies_tmdb.py

@@ -22,40 +22,46 @@ from typing import List, Dict
 _NOW_PLAYING = "https://api.themoviedb.org/3/movie/now_playing"
 
 
-def _read_token() -> str:
-    return os.getenv("TMDB_READ_TOKEN", "")
+def _credential():
+    """Accept the token in either env var and auto-detect its type, so it works
+    whether the user pasted a v3 API key or a v4 Read Access Token, in either
+    slot. v4 tokens are long JWTs beginning 'eyJ'; v3 keys are short hex."""
+    val = (os.getenv("TMDB_READ_TOKEN") or os.getenv("TMDB_API_KEY") or "").strip()
+    is_v4 = val.startswith("eyJ") or len(val) > 45
+    return val, is_v4
 
 
 def is_live() -> bool:
-    return bool(_read_token() or os.getenv("TMDB_API_KEY")) and os.getenv("MOVIES_MOCK") != "1"
+    val, _ = _credential()
+    return bool(val) and os.getenv("MOVIES_MOCK") != "1"
 
 
-def now_playing(limit: int = 24) -> List[Dict]:
-    """Current theatrical releases, most popular first. Falls back to the
-    curated list when no credential is configured."""
-    if not is_live():
-        return _curated()
+def now_playing(limit: int = 24):
+    """Returns (movies, source). source is 'tmdb' on a live hit, else a 'curated…'
+    string that names why we fell back - so a caller can diagnose a bad key."""
+    val, is_v4 = _credential()
+    if not val or os.getenv("MOVIES_MOCK") == "1":
+        return _curated(), "curated (no credential)"
     import httpx
-    region = os.getenv("TMDB_REGION", "IN")
-    params = {"region": region, "language": "en-US", "page": 1}
+    params = {"region": os.getenv("TMDB_REGION", "IN"), "language": "en-US", "page": 1}
     headers = {}
-    if _read_token():
-        headers["Authorization"] = f"Bearer {_read_token()}"     # v4
+    if is_v4:
+        headers["Authorization"] = f"Bearer {val}"               # v4 read token
     else:
-        params["api_key"] = os.environ["TMDB_API_KEY"]           # v3
+        params["api_key"] = val                                  # v3 api key
     try:
         r = httpx.get(_NOW_PLAYING, params=params, headers=headers, timeout=10.0)
         r.raise_for_status()
         rows = r.json().get("results", [])
-    except Exception:
-        return _curated()                                        # never break the dropdown
+    except Exception as e:                                        # never break the dropdown
+        return _curated(), f"curated (tmdb error: {type(e).__name__})"
     rows.sort(key=lambda m: m.get("popularity", 0), reverse=True)
     out: List[Dict] = []
     for m in rows[:limit]:
         title = m.get("title") or m.get("original_title")
         if title:
             out.append({"title": title, "release_date": m.get("release_date"), "id": m.get("id")})
-    return out or _curated()
+    return (out, "tmdb") if out else (_curated(), "curated (tmdb empty)") or _curated()
 
 
 # Curated fallback: titles in Indian theatres as of Jul 2026. Refresh when stale,