Realized that the IndieAuth for WordPress update I pushed last week, because it uses more secure SHA256 hashing, should have prompted people to refresh their tokens. Sorry everyone. You’ll have to revoke your old tokens and get new ones. Apologies. Good opportunity to visit the manage token page under the User menu if you’ve never seen it.