Faster random draws, a new EU home, and clearer errors

What's new

• A new home in the EU. QuizBase now runs on its own server in an EU data center, behind Cloudflare. The privacy policy and terms list the new hosting provider. As part of the move all sessions were reset, so you may need to sign in to the dashboard again. API keys were not affected and keep working.

• Much faster random draws. GET /v1/questions/random with language, type, quality and difficulty filters now draws from a precomputed pool: a few milliseconds of database time instead of 300+, with the same perfectly uniform distribution. Discovery endpoints (/tags, /subcategories, /topics, /languages, /regions) also got cheaper. In our latest load test the API served 50 requests per second with a p95 around 65 ms and stayed error-free at 400 requests per second. Numbers and raw results: performance.

• regions now means cultural affinity. The field tells you who is likely to know the answer, not where the topic comes from. Global pop culture and general knowledge now carry no region (universal), so ?regions=pl or any other non-English market returns them instead of an empty pool. Over half of the English catalog is now universal, and Polish translations mirror the English tags exactly.

Details

• 401 malformed_api_key tells you what went wrong. The response now includes expected_length, received_length and prefix_recognized, and names the likely cause when we can tell from the shape alone: a whole .env line pasted as the secret, an unexpanded variable, quotes, whitespace or extra characters around the key. The key itself never appears in the response.
• 429 for the daily limit shows the daily limit. When you run out of daily requests, the limit field in the response body now reports your daily quota instead of the 10-second burst value.
• The 20-key cap counts only active keys. Keys that were disabled no longer take up a slot.
• Clearer copy buttons in the new-key dialog: "Copy key" and "Copy .env line", with a hint that secret managers expect the bare key.
• Account hardening. Billing fields on your account can no longer be changed from the browser.
• Pricing FAQ, precisely. Every call to /v1/* with your key counts as one request, including /v1/stats and the discovery endpoints. Dump downloads from /data don't need a key and don't count.
• MCP auth discovery at the path-specific address. Protected resource metadata for the MCP server is now also served at /.well-known/oauth-protected-resource/mcp (RFC 9728 section 3.1), for MCP clients that derive the address instead of reading it from the WWW-Authenticate header.
• Docs fixes. Notes and warnings across the guides rendered raw Markdown in some places; they now show proper code and formatting.