Six things broke before "Alexa, what's due today?" finally worked. A debugging war story.

I added an Alexa skill to my to-do app (Tasqs) so I could ask "Alexa, what's due today?" and hear my list back. The actual voice logic took an afternoon (or so). Getting Alexa to reach my server at all took two weeks and broke at six separate layers, each hiding the next. Writing it up because I'd have killed for this list when I started.

The setup: my app sits behind Cloudflare, and Alexa links to a user's account over OAuth. So a voice request has to survive Amazon's signature checks, my OAuth server, Cloudflare, and my origin before it ever runs a query. Every one of those had a problem.

1. The SSL cert. Alexa's account-linking rejects Let's Encrypt certs (which is what my edge was serving). Spent a day convinced my cert chain was broken before realizing it was valid, just from a CA Amazon doesn't accept. Had to switch to a different certificate authority.

2. The client secret silently went blank. Amazon's console never re-displays a saved OAuth secret, and it happily saved an empty one during an unrelated edit. Result: token exchange failing with "invalid client" while the console looked correct.

3. My OAuth client row got deleted. From working in the database during the cert mess. Now the authorize step threw "Unknown application." Wrote a little script to recreate it that pins the original ID so I only ever have to re-paste the secret. (This one was my fault!)

4. Placeholder redirect URLs. I'd saved the literal string "YOUR_VENDOR_ID" as a redirect URI (the match is exact), so every attempt bounced with "Invalid return address." Had to register all three of Amazon's real redirect URLs verbatim.

5. A silent length cap in my own code. My login-redirect helper truncated anything over 500 characters as a safety measure. Alexa's linking URL is ~1,300 characters. So linking worked perfectly if you were already logged in, and silently lost its way if you weren't. Intermittent bugs are the worst bugs.

6. The one that broke my brain: Cloudflare's Bot Fight Mode. Amazon's server-to-server token call was getting challenged at the edge as "suspicious bot traffic" (which, fair, it's a datacenter making an automated POST). The request never reached my server, so it appeared in zero logs on my end. I only cracked it by noticing my auth codes were being generated but never consumed, which proved the exchange was never arriving. The fix was a Cloudflare setting. My actual code was fine.

The lesson that stuck: when something works in a browser but fails for a machine-to-machine caller, your logs are lying to you by omission. The request dying at the edge looks identical to a request that was never made. I burned days looking at my origin when the answer was in Cloudflare's security event log the whole time.

And all that was just to make it work. Naming it (the Invocation Name) was its own saga. "Tasqs" is a deliberate respelling of "tasks," which reads fine but is a real problem for a voice assistant. Amazon's own rules say a compound invocation name has to be made of actual, recognizable words, and the name can't be one Alexa confuses with a common command, and "Tasqs [word]" is phonetically just "tasks [word]." A pile of combinations kept getting bounced, and non-punny alternates ran into other rules ("Big Rocks" got rejected too, best guess a collision with something music-related). The name that reads best on a screen is the one your voice assistant can't hear.

Anyway, it works now, I finally received the "Your Amazon Skill is live" email and hearing my own to-do list read back the first time was genuinely one of the better moments of this project. Happy to go deeper on any layer if it's useful to someone hitting the same wall.