Add Instapaper integration with automatic article sending

Features:
- Automatically send bookmarks to Instapaper when tagged with reading list tag
- Encrypted credential storage using AES-GCM encryption
- Credential validation before saving (tests Instapaper API connection)
- Settings UI with toggle, username/password fields
- Enhanced success feedback with checkmark and verification message
- Silent failure pattern: bookmark updates succeed even if Instapaper fails

Security:
- Separate ENCRYPTION_KEY environment variable for credential encryption
- AES-GCM with 256-bit key derived via PBKDF2 (100,000 iterations)
- Passwords never logged or returned in API responses
- Credentials only decrypted when actively needed

OAuth improvements:
- Fix BASE_URL auto-detection to properly handle ngrok HTTPS forwarding
- Check X-Forwarded-Proto header for correct protocol detection
- Support dynamic ngrok URLs without manual configuration

Database:
- Migration 002: Add instapaper_enabled, instapaper_username_encrypted,
instapaper_password_encrypted columns to user_settings

Testing:
- All 73 tests passing
- Unit tests for encryption round-trip
- Unit tests for Instapaper API client with mocked fetch
- Integration tests for settings API with credential validation

.env.example

···
 # You can generate one with: openssl rand -base64 32
 COOKIE_SECRET=your-secure-random-secret-minimum-32-chars-long
 
+# Encryption key for sensitive user data (e.g., Instapaper credentials)
+# IMPORTANT: Generate a secure random string (minimum 32 characters)
+# You can generate one with: openssl rand -base64 32
+ENCRYPTION_KEY=your-secure-encryption-key-minimum-32-chars-long
+
 # Optional: Custom port for local dev server (default: 8000)
 # PORT=8000
 

deno.json

···
     "preview": "deno run -A main.ts",
     "quality": "deno fmt --check && deno lint",
     "check": "deno check --allow-import main.ts",
-    "test": "TURSO_DATABASE_URL=libsql://test.turso.io TURSO_AUTH_TOKEN=test COOKIE_SECRET=test-cookie-secret-32-characters-minimum deno test --allow-all --unstable-kv tests/",
+    "test": "TURSO_DATABASE_URL=file::memory: COOKIE_SECRET=test-cookie-secret-32-characters-minimum ENCRYPTION_KEY=test-encryption-key-for-unit-tests-only-minimum-32-chars deno test --allow-all --unstable-kv tests/",
     "test:watch": "COOKIE_SECRET=test-cookie-secret-32-characters-minimum deno test --allow-all --watch",
     "fmt": "deno fmt",
     "lint": "deno lint"

frontend/components/Settings.tsx

···
 export function Settings() {
   const { settings, updateSettings } = useApp();
   const [readingListTag, setReadingListTag] = useState(settings.readingListTag);
+  const [instapaperEnabled, setInstapaperEnabled] = useState(
+    settings.instapaperEnabled,
+  );
+  const [instapaperUsername, setInstapaperUsername] = useState(
+    settings.instapaperUsername || "",
+  );
+  const [instapaperPassword, setInstapaperPassword] = useState("");
   const [saving, setSaving] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [success, setSuccess] = useState(false);
···
   // Sync local state when settings from context change
   useEffect(() => {
     setReadingListTag(settings.readingListTag);
-  }, [settings.readingListTag]);
+    setInstapaperEnabled(settings.instapaperEnabled);
+    setInstapaperUsername(settings.instapaperUsername || "");
+  }, [
+    settings.readingListTag,
+    settings.instapaperEnabled,
+    settings.instapaperUsername,
+  ]);
 
   async function handleSubmit(e: React.FormEvent) {
     e.preventDefault();
···
     setSaving(true);
 
     try {
-      await updateSettings({ readingListTag: readingListTag.trim() });
+      const updates: any = {
+        readingListTag: readingListTag.trim(),
+        instapaperEnabled,
+      };
+
+      // Only send credentials if Instapaper is enabled
+      if (instapaperEnabled) {
+        // Always include username if enabled
+        updates.instapaperUsername = instapaperUsername.trim();
+
+        // Only include password if changed (not empty)
+        if (instapaperPassword.trim().length > 0) {
+          updates.instapaperPassword = instapaperPassword;
+        }
+      }
+
+      await updateSettings(updates);
       setSuccess(true);
+      setInstapaperPassword(""); // Clear password field after save
       setTimeout(() => setSuccess(false), 3000);
     } catch (err: any) {
       setError(err.message || "Failed to save settings");
···
     }
   }
 
-  const hasChanges = readingListTag.trim() !== settings.readingListTag;
+  const hasChanges = readingListTag.trim() !== settings.readingListTag ||
+    instapaperEnabled !== settings.instapaperEnabled ||
+    (instapaperEnabled &&
+      instapaperUsername.trim() !== (settings.instapaperUsername || "")) ||
+    instapaperPassword.trim().length > 0;
 
   return (
     <div className="min-h-screen bg-gray-50">
···
                 </p>
               </div>
             </div>
+          </section>
 
-            {error && (
-              <div className="p-3 bg-red-50 border border-red-200 rounded-lg text-red-700 text-sm">
-                {error}
+          {/* Instapaper Integration Section */}
+          <section className="bg-white rounded-lg shadow-md p-6 space-y-6">
+            <div>
+              <h3 className="text-xl font-bold text-gray-800 mb-4">
+                Instapaper Integration
+              </h3>
+              <p className="text-gray-600 mb-4">
+                Automatically send articles to Instapaper when you tag them with
+                your reading list tag ("{readingListTag || "toread"}").
+              </p>
+
+              {/* Enable toggle */}
+              <div className="flex items-center space-x-3 mb-4">
+                <input
+                  type="checkbox"
+                  id="instapaperEnabled"
+                  checked={instapaperEnabled}
+                  onChange={(e) => setInstapaperEnabled(e.target.checked)}
+                  className="w-4 h-4 rounded border-gray-300 text-coral focus:ring-coral"
+                />
+                <label
+                  htmlFor="instapaperEnabled"
+                  className="text-sm font-medium text-gray-700"
+                >
+                  Send articles to Instapaper
+                </label>
               </div>
-            )}
+
+              {/* Credentials (shown when enabled) */}
+              {instapaperEnabled && (
+                <div className="space-y-4 pl-7">
+                  <div className="space-y-2">
+                    <label
+                      htmlFor="instapaperUsername"
+                      className="block text-sm font-medium text-gray-700"
+                    >
+                      Instapaper Email/Username
+                    </label>
+                    <input
+                      type="text"
+                      id="instapaperUsername"
+                      value={instapaperUsername}
+                      onChange={(e) => setInstapaperUsername(e.target.value)}
+                      placeholder="[e-mail]"
+                      className="w-full max-w-md px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-coral/50 focus:border-coral"
+                      required={instapaperEnabled}
+                    />
+                  </div>
 
-            {success && (
-              <div className="p-3 bg-green-50 border border-green-200 rounded-lg text-green-700 text-sm">
-                Settings saved successfully!
-              </div>
-            )}
+                  <div className="space-y-2">
+                    <label
+                      htmlFor="instapaperPassword"
+                      className="block text-sm font-medium text-gray-700"
+                    >
+                      Instapaper Password
+                    </label>
+                    <input
+                      type="password"
+                      id="instapaperPassword"
+                      value={instapaperPassword}
+                      onChange={(e) => setInstapaperPassword(e.target.value)}
+                      placeholder={settings.instapaperUsername
+                        ? "Leave blank to keep current password"
+                        : "Enter password"}
+                      className="w-full max-w-md px-3 py-2 border border-gray-300 rounded-lg focus:outline-none focus:ring-2 focus:ring-coral/50 focus:border-coral"
+                      required={instapaperEnabled &&
+                        !settings.instapaperUsername}
+                    />
+                    <p className="text-xs text-gray-500">
+                      {settings.instapaperUsername
+                        ? "Leave blank to keep your current password"
+                        : "Your password is encrypted and stored securely"}
+                    </p>
+                  </div>
 
-            <div className="pt-4 border-t border-gray-200">
-              <button
-                type="submit"
-                disabled={saving || !hasChanges}
-                className="px-6 py-2 rounded-lg font-medium text-white transition-opacity disabled:opacity-50 disabled:cursor-not-allowed"
-                style={{ backgroundColor: "var(--coral)" }}
-              >
-                {saving ? "Saving..." : "Save Settings"}
-              </button>
+                  <div className="p-3 bg-blue-50 border border-blue-200 rounded-lg">
+                    <p className="text-sm text-blue-800">
+                      When you tag a bookmark with "{readingListTag || "toread"}
+                      ", it will be automatically sent to your Instapaper
+                      account.
+                    </p>
+                  </div>
+                </div>
+              )}
             </div>
           </section>
+
+          {error && (
+            <div className="p-3 bg-red-50 border border-red-200 rounded-lg text-red-700 text-sm">
+              {error}
+            </div>
+          )}
+
+          {success && (
+            <div className="p-4 bg-green-50 border border-green-200 rounded-lg">
+              <div className="flex items-start gap-3">
+                <svg
+                  className="w-5 h-5 text-green-600 flex-shrink-0 mt-0.5"
+                  fill="currentColor"
+                  viewBox="0 0 20 20"
+                >
+                  <path
+                    fillRule="evenodd"
+                    d="M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.293a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z"
+                    clipRule="evenodd"
+                  />
+                </svg>
+                <div className="flex-1">
+                  <p className="text-sm font-medium text-green-800">
+                    Settings saved successfully!
+                  </p>
+                  {instapaperEnabled && (
+                    <p className="text-sm text-green-700 mt-1">
+                      ✓ Instapaper connection verified - your articles will be sent
+                      automatically
+                    </p>
+                  )}
+                </div>
+              </div>
+            </div>
+          )}
+
+          {/* Save Button */}
+          <div className="pt-4 border-t border-gray-200">
+            <button
+              type="submit"
+              disabled={saving || !hasChanges}
+              className="px-6 py-2 rounded-lg font-medium text-white transition-opacity disabled:opacity-50 disabled:cursor-not-allowed"
+              style={{ backgroundColor: "var(--coral)" }}
+            >
+              {saving ? "Saving..." : "Save Settings"}
+            </button>
+          </div>
         </form>
       </main>
     </div>

frontend/context/AppContext.tsx

···
 
 const DEFAULT_SETTINGS: UserSettings = {
   readingListTag: "toread",
+  instapaperEnabled: false,
 };
 
 interface AppState {

lib/encryption.ts

···
+/**
+ * Encryption utilities for sensitive user data.
+ * Uses Web Crypto API with AES-GCM for secure encryption.
+ */
+
+const ENCRYPTION_KEY = Deno.env.get("ENCRYPTION_KEY");
+const ALGORITHM = "AES-GCM";
+const KEY_LENGTH = 256;
+
+/**
+ * Derive a CryptoKey from the ENCRYPTION_KEY environment variable.
+ * Cached for performance.
+ */
+let cachedKey: CryptoKey | null = null;
+
+async function getEncryptionKey(): Promise<CryptoKey> {
+  if (!ENCRYPTION_KEY) {
+    throw new Error("ENCRYPTION_KEY environment variable is required");
+  }
+
+  if (cachedKey) {
+    return cachedKey;
+  }
+
+  // Derive key from environment variable using PBKDF2
+  const encoder = new TextEncoder();
+  const keyMaterial = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(ENCRYPTION_KEY),
+    "PBKDF2",
+    false,
+    ["deriveKey"],
+  );
+
+  cachedKey = await crypto.subtle.deriveKey(
+    {
+      name: "PBKDF2",
+      salt: encoder.encode("kipclip-instapaper-v1"), // Static salt for deterministic key
+      iterations: 100000,
+      hash: "SHA-256",
+    },
+    keyMaterial,
+    { name: ALGORITHM, length: KEY_LENGTH },
+    false,
+    ["encrypt", "decrypt"],
+  );
+
+  return cachedKey;
+}
+
+/**
+ * Encrypt a plaintext string.
+ * Returns base64-encoded ciphertext with IV prepended.
+ */
+export async function encrypt(plaintext: string): Promise<string> {
+  const key = await getEncryptionKey();
+  const encoder = new TextEncoder();
+  const data = encoder.encode(plaintext);
+
+  // Generate random IV (12 bytes for GCM)
+  const iv = crypto.getRandomValues(new Uint8Array(12));
+
+  const ciphertext = await crypto.subtle.encrypt(
+    { name: ALGORITHM, iv },
+    key,
+    data,
+  );
+
+  // Prepend IV to ciphertext (IV is not secret)
+  const combined = new Uint8Array(iv.length + ciphertext.byteLength);
+  combined.set(iv, 0);
+  combined.set(new Uint8Array(ciphertext), iv.length);
+
+  // Return base64-encoded string
+  return btoa(String.fromCharCode(...combined));
+}
+
+/**
+ * Decrypt a ciphertext string.
+ * Expects base64-encoded ciphertext with IV prepended.
+ */
+export async function decrypt(ciphertext: string): Promise<string> {
+  const key = await getEncryptionKey();
+
+  // Decode base64
+  const combined = Uint8Array.from(atob(ciphertext), (c) => c.charCodeAt(0));
+
+  // Extract IV (first 12 bytes) and ciphertext
+  const iv = combined.slice(0, 12);
+  const data = combined.slice(12);
+
+  const plaintext = await crypto.subtle.decrypt(
+    { name: ALGORITHM, iv },
+    key,
+    data,
+  );
+
+  const decoder = new TextDecoder();
+  return decoder.decode(plaintext);
+}

lib/instapaper.ts

···
+/**
+ * Instapaper Simple API client.
+ * Sends articles to Instapaper using the Simple API.
+ * https://www.instapaper.com/api/simple
+ */
+
+export interface InstapaperCredentials {
+  username: string;
+  password: string;
+}
+
+export interface InstapaperAddResult {
+  success: boolean;
+  error?: string;
+}
+
+/**
+ * Send an article to Instapaper.
+ * Uses Simple API with basic authentication.
+ */
+export async function sendToInstapaper(
+  url: string,
+  credentials: InstapaperCredentials,
+  title?: string,
+): Promise<InstapaperAddResult> {
+  try {
+    // Validate URL
+    const parsedUrl = new URL(url);
+    if (!parsedUrl.protocol.startsWith("http")) {
+      throw new Error("Only HTTP(S) URLs are supported");
+    }
+
+    // Build API request
+    const apiUrl = new URL("https://www.instapaper.com/api/add");
+    apiUrl.searchParams.set("url", url);
+    if (title) {
+      apiUrl.searchParams.set("title", title);
+    }
+
+    // Use Basic Authentication
+    const authHeader = `Basic ${
+      btoa(`${credentials.username}:${credentials.password}`)
+    }`;
+
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 10000); // 10s timeout
+
+    const response = await fetch(apiUrl.toString(), {
+      method: "GET",
+      signal: controller.signal,
+      headers: {
+        "Authorization": authHeader,
+        "User-Agent": "kipclip/1.0 (+https://kipclip.com)",
+      },
+    });
+
+    clearTimeout(timeoutId);
+
+    // Instapaper returns 201 on success
+    if (response.status === 201) {
+      return { success: true };
+    }
+
+    // Handle error responses
+    const statusText = response.statusText || "Unknown error";
+
+    if (response.status === 403) {
+      return {
+        success: false,
+        error: "Invalid Instapaper credentials",
+      };
+    }
+
+    if (response.status === 400) {
+      return {
+        success: false,
+        error: "Invalid URL or request",
+      };
+    }
+
+    if (response.status === 500) {
+      return {
+        success: false,
+        error: "Instapaper service error",
+      };
+    }
+
+    return {
+      success: false,
+      error: `Instapaper API error: ${response.status} ${statusText}`,
+    };
+  } catch (error: any) {
+    console.error("Failed to send to Instapaper:", error);
+
+    if (error.name === "AbortError") {
+      return {
+        success: false,
+        error: "Request to Instapaper timed out",
+      };
+    }
+
+    return {
+      success: false,
+      error: error.message || "Failed to send to Instapaper",
+    };
+  }
+}
+
+/**
+ * Validate Instapaper credentials by attempting authentication.
+ * Returns true if credentials are valid.
+ */
+export async function validateInstapaperCredentials(
+  credentials: InstapaperCredentials,
+): Promise<{ valid: boolean; error?: string }> {
+  try {
+    const authUrl = "https://www.instapaper.com/api/authenticate";
+    const authHeader = `Basic ${
+      btoa(`${credentials.username}:${credentials.password}`)
+    }`;
+
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 5000);
+
+    const response = await fetch(authUrl, {
+      method: "GET",
+      signal: controller.signal,
+      headers: {
+        "Authorization": authHeader,
+        "User-Agent": "kipclip/1.0 (+https://kipclip.com)",
+      },
+    });
+
+    clearTimeout(timeoutId);
+
+    if (response.status === 200) {
+      return { valid: true };
+    }
+
+    if (response.status === 403) {
+      return { valid: false, error: "Invalid username or password" };
+    }
+
+    return {
+      valid: false,
+      error: `Authentication failed: ${response.status}`,
+    };
+  } catch (error: any) {
+    console.error("Failed to validate Instapaper credentials:", error);
+
+    if (error.name === "AbortError") {
+      return { valid: false, error: "Request timed out" };
+    }
+
+    return {
+      valid: false,
+      error: error.message || "Validation failed",
+    };
+  }
+}

lib/migrations.ts

···
       CREATE INDEX IF NOT EXISTS idx_user_settings_did ON user_settings(did)
     `,
   },
+  {
+    version: "002",
+    description: "Add Instapaper integration fields to user_settings",
+    sql: `
+      ALTER TABLE user_settings ADD COLUMN instapaper_enabled INTEGER DEFAULT 0;
+      ALTER TABLE user_settings ADD COLUMN instapaper_username_encrypted TEXT;
+      ALTER TABLE user_settings ADD COLUMN instapaper_password_encrypted TEXT
+    `,
+  },
 ];
 
 export async function runMigrations() {

lib/oauth-config.ts

···
 import { rawDb } from "./db.ts";
 import { OAUTH_SCOPES } from "./route-utils.ts";
 
-// Cookie secret is always required
-const COOKIE_SECRET = Deno.env.get("COOKIE_SECRET");
-if (!COOKIE_SECRET) {
-  throw new Error("COOKIE_SECRET environment variable is required");
-}
-
 // OAuth instance and base URL - initialized lazily
 let oauth: ReturnType<typeof createATProtoOAuth> | null = null;
 let baseUrl: string | null = Deno.env.get("BASE_URL") || null;
···
 }
 
 /**
- * Initialize OAuth with the given request URL.
+ * Initialize OAuth with the given request.
  * If BASE_URL env var is set, uses that. Otherwise derives from request.
  * Safe to call multiple times - only initializes once.
  */
 export function initOAuth(
-  requestUrl: string,
+  request: Request,
 ): ReturnType<typeof createATProtoOAuth> {
   if (oauth) return oauth;
 
+  // Cookie secret is required
+  const COOKIE_SECRET = Deno.env.get("COOKIE_SECRET");
+  if (!COOKIE_SECRET) {
+    throw new Error("COOKIE_SECRET environment variable is required");
+  }
+
   // Derive base URL from request if not set in environment
   if (!baseUrl) {
-    const url = new URL(requestUrl);
-    baseUrl = `${url.protocol}//${url.host}`;
+    const url = new URL(request.url);
+    // Check for X-Forwarded-Proto header (set by ngrok and other proxies)
+    const forwardedProto = request.headers.get("X-Forwarded-Proto");
+    const protocol = forwardedProto || url.protocol.replace(":", "");
+    baseUrl = `${protocol}://${url.host}`;
     console.log(`Derived BASE_URL from request: ${baseUrl}`);
   }
 

lib/session.ts

···
   testSessionProvider = provider;
 }
 
-// Session configuration from environment
-const COOKIE_SECRET = Deno.env.get("COOKIE_SECRET");
-if (!COOKIE_SECRET) {
-  throw new Error("COOKIE_SECRET environment variable is required");
+// Session configuration from environment (lazy-loaded)
+let sessions: SessionManager | null = null;
+
+function getSessionManager(): SessionManager {
+  if (!sessions) {
+    const COOKIE_SECRET = Deno.env.get("COOKIE_SECRET");
+    if (!COOKIE_SECRET) {
+      throw new Error("COOKIE_SECRET environment variable is required");
+    }
+
+    // Create session manager for cookie handling (framework-agnostic)
+    sessions = new SessionManager({
+      cookieSecret: COOKIE_SECRET,
+      cookieName: "sid",
+      sessionTtl: 60 * 60 * 24 * 14, // 14 days
+      logger: console,
+    });
+  }
+  return sessions;
 }
-
-// Create session manager for cookie handling (framework-agnostic)
-const sessions = new SessionManager({
-  cookieSecret: COOKIE_SECRET,
-  cookieName: "sid",
-  sessionTtl: 60 * 60 * 24 * 14, // 14 days
-  logger: console,
-});
 
 export interface SessionResult {
   session: SessionInterface | null;
···
 
   try {
     // Step 1: Extract session data from cookie using atproto-sessions
-    const cookieResult = await sessions.getSessionFromRequest(request);
+    const cookieResult = await getSessionManager().getSessionFromRequest(
+      request,
+    );
 
     if (!cookieResult.data) {
       const errorType = cookieResult.error?.type || "NO_SESSION";
···
  * Get clear cookie header for session cleanup.
  */
 export function getClearSessionCookie(): string {
-  return sessions.getClearCookieHeader();
+  return getSessionManager().getClearCookieHeader();
 }

lib/settings.ts

···
 
 import { rawDb } from "./db.ts";
 import type { UserSettings } from "../shared/types.ts";
+import { decrypt, encrypt } from "./encryption.ts";
 
 const DEFAULT_READING_LIST_TAG = "toread";
 
···
 export async function getUserSettings(did: string): Promise<UserSettings> {
   // Try to get existing settings
   const result = await rawDb.execute({
-    sql: "SELECT reading_list_tag FROM user_settings WHERE did = ?",
+    sql: `SELECT
+            reading_list_tag,
+            instapaper_enabled,
+            instapaper_username_encrypted
+          FROM user_settings
+          WHERE did = ?`,
     args: [did],
   });
 
   if (result.rows && result.rows.length > 0) {
-    const row = result.rows[0] as string[];
+    const row = result.rows[0] as (string | number | null)[];
+    const readingListTag = String(row[0] || DEFAULT_READING_LIST_TAG);
+    const instapaperEnabled = row[1] === 1 || row[1] === "1";
+    const encryptedUsername = row[2] ? String(row[2]) : null;
+
+    // Decrypt username if available
+    let instapaperUsername: string | undefined;
+    if (instapaperEnabled && encryptedUsername) {
+      try {
+        instapaperUsername = await decrypt(encryptedUsername);
+      } catch (error) {
+        console.error("Failed to decrypt Instapaper username:", error);
+      }
+    }
+
     return {
-      readingListTag: row[0] || DEFAULT_READING_LIST_TAG,
+      readingListTag,
+      instapaperEnabled,
+      instapaperUsername,
     };
   }
 
···
 
   return {
     readingListTag: DEFAULT_READING_LIST_TAG,
+    instapaperEnabled: false,
   };
 }
 
···
  */
 export async function updateUserSettings(
   did: string,
-  updates: Partial<UserSettings>,
+  updates: Partial<UserSettings> & { instapaperPassword?: string },
 ): Promise<UserSettings> {
   // Validate reading list tag if provided
   if (updates.readingListTag !== undefined) {
···
     updates.readingListTag = tag;
   }
 
+  // Validate Instapaper settings
+  if (updates.instapaperEnabled) {
+    // Check if credentials are provided or already exist
+    if (!updates.instapaperUsername && !updates.instapaperPassword) {
+      const existing = await rawDb.execute({
+        sql: `SELECT instapaper_username_encrypted
+              FROM user_settings
+              WHERE did = ?`,
+        args: [did],
+      });
+
+      if (!existing.rows?.[0]?.[0]) {
+        throw new Error("Instapaper username and password are required");
+      }
+    }
+
+    if (
+      updates.instapaperUsername &&
+      updates.instapaperUsername.trim().length === 0
+    ) {
+      throw new Error("Instapaper username cannot be empty");
+    }
+
+    if (updates.instapaperPassword && updates.instapaperPassword.length === 0) {
+      throw new Error("Instapaper password cannot be empty");
+    }
+  }
+
   // Check if settings exist
   const existing = await rawDb.execute({
     sql: "SELECT id FROM user_settings WHERE did = ?",
     args: [did],
   });
 
-  if (existing.rows && existing.rows.length > 0) {
-    // Update existing settings
-    if (updates.readingListTag !== undefined) {
-      await rawDb.execute({
-        sql: `UPDATE user_settings
-              SET reading_list_tag = ?, updated_at = CURRENT_TIMESTAMP
-              WHERE did = ?`,
-        args: [updates.readingListTag, did],
-      });
-    }
-  } else {
-    // Create new settings with provided values or defaults
+  const settingsExist = existing.rows && existing.rows.length > 0;
+
+  // Build update query dynamically
+  const updateFields: string[] = [];
+  const updateValues: (string | number)[] = [];
+
+  if (updates.readingListTag !== undefined) {
+    updateFields.push("reading_list_tag = ?");
+    updateValues.push(updates.readingListTag);
+  }
+
+  if (updates.instapaperEnabled !== undefined) {
+    updateFields.push("instapaper_enabled = ?");
+    updateValues.push(updates.instapaperEnabled ? 1 : 0);
+  }
+
+  // Encrypt and update credentials if provided
+  if (updates.instapaperUsername !== undefined) {
+    const encrypted = await encrypt(updates.instapaperUsername.trim());
+    updateFields.push("instapaper_username_encrypted = ?");
+    updateValues.push(encrypted);
+  }
+
+  if (updates.instapaperPassword !== undefined) {
+    const encrypted = await encrypt(updates.instapaperPassword);
+    updateFields.push("instapaper_password_encrypted = ?");
+    updateValues.push(encrypted);
+  }
+
+  if (settingsExist && updateFields.length > 0) {
+    updateFields.push("updated_at = CURRENT_TIMESTAMP");
+    updateValues.push(did); // WHERE did = ?
+
     await rawDb.execute({
-      sql: "INSERT INTO user_settings (did, reading_list_tag) VALUES (?, ?)",
-      args: [did, updates.readingListTag || DEFAULT_READING_LIST_TAG],
+      sql: `UPDATE user_settings
+            SET ${updateFields.join(", ")}
+            WHERE did = ?`,
+      args: updateValues,
+    });
+  } else if (!settingsExist) {
+    // Create new settings
+    const encryptedUsername = updates.instapaperUsername
+      ? await encrypt(updates.instapaperUsername.trim())
+      : null;
+    const encryptedPassword = updates.instapaperPassword
+      ? await encrypt(updates.instapaperPassword)
+      : null;
+
+    await rawDb.execute({
+      sql: `INSERT INTO user_settings
+            (did, reading_list_tag, instapaper_enabled,
+             instapaper_username_encrypted, instapaper_password_encrypted)
+            VALUES (?, ?, ?, ?, ?)`,
+      args: [
+        did,
+        updates.readingListTag || DEFAULT_READING_LIST_TAG,
+        updates.instapaperEnabled ? 1 : 0,
+        encryptedUsername,
+        encryptedPassword,
+      ],
     });
   }
 

main.ts

···
  * Orchestrates route registration and middleware setup.
  */
 
+// Load environment variables from .env file (local development)
+import { load } from "@std/dotenv";
+try {
+  await load({ export: true });
+  console.log("✅ Loaded .env file");
+} catch (error) {
+  console.warn("⚠️ Failed to load .env file:", error.message);
+}
+
 import { App, staticFiles } from "@fresh/core";
 import { initializeTables } from "./lib/db.ts";
 import { initOAuth } from "./lib/oauth-config.ts";
···
 
 // Initialize OAuth on first request (derives BASE_URL from request if not set)
 app = app.use(async (ctx) => {
-  initOAuth(ctx.req.url);
+  initOAuth(ctx.req);
   return await ctx.next();
 });
 

routes/api/bookmarks.ts

···
   getSessionFromRequest,
   setSessionCookie,
 } from "../../lib/route-utils.ts";
+import { getUserSettings } from "../../lib/settings.ts";
+import { sendToInstapaper } from "../../lib/instapaper.ts";
+import { decrypt } from "../../lib/encryption.ts";
+import { rawDb } from "../../lib/db.ts";
 import type {
   AddBookmarkRequest,
   AddBookmarkResponse,
···
         favicon: record.$enriched?.favicon,
       };
 
+      // Check if should send to Instapaper
+      const settings = await getUserSettings(oauthSession.did);
+      const hasReadingListTag = record.tags.includes(settings.readingListTag);
+      const hadReadingListTag =
+        currentRecord.value.tags?.includes(settings.readingListTag) || false;
+      const isNewReadingListItem = hasReadingListTag && !hadReadingListTag;
+
+      if (settings.instapaperEnabled && isNewReadingListItem) {
+        sendToInstapaperAsync(
+          oauthSession.did,
+          record.subject,
+          record.$enriched?.title,
+        ).catch((error) =>
+          console.error("Failed to send bookmark to Instapaper:", error)
+        );
+      }
+
       const result: UpdateBookmarkTagsResponse = { success: true, bookmark };
       return setSessionCookie(Response.json(result), setCookieHeader);
     } catch (error: any) {
···
 
   return app;
 }
+
+/**
+ * Helper function to send bookmark to Instapaper asynchronously.
+ * Fetches credentials, decrypts them, and sends to Instapaper.
+ * Silent failure: logs errors but doesn't throw.
+ */
+async function sendToInstapaperAsync(
+  did: string,
+  url: string,
+  title?: string,
+): Promise<void> {
+  try {
+    // Fetch encrypted credentials
+    const result = await rawDb.execute({
+      sql: `SELECT instapaper_username_encrypted, instapaper_password_encrypted
+            FROM user_settings
+            WHERE did = ? AND instapaper_enabled = 1`,
+      args: [did],
+    });
+
+    if (!result.rows?.[0]) {
+      console.warn("Instapaper credentials not found for user:", did);
+      return;
+    }
+
+    const [encryptedUsername, encryptedPassword] = result.rows[0] as string[];
+
+    if (!encryptedUsername || !encryptedPassword) {
+      console.warn("Instapaper credentials incomplete for user:", did);
+      return;
+    }
+
+    // Decrypt credentials
+    const username = await decrypt(encryptedUsername);
+    const password = await decrypt(encryptedPassword);
+
+    // Send to Instapaper
+    const instapaperResult = await sendToInstapaper(
+      url,
+      { username, password },
+      title,
+    );
+
+    if (instapaperResult.success) {
+      console.log(`Successfully sent to Instapaper: ${url}`);
+    } else {
+      console.error(
+        `Failed to send to Instapaper: ${instapaperResult.error}`,
+        { url, did },
+      );
+    }
+  } catch (error) {
+    console.error("Error in sendToInstapaperAsync:", error);
+    throw error;
+  }
+}

routes/api/settings.ts

···
   setSessionCookie,
 } from "../../lib/route-utils.ts";
 import { getUserSettings, updateUserSettings } from "../../lib/settings.ts";
+import { validateInstapaperCredentials } from "../../lib/instapaper.ts";
+import { decrypt } from "../../lib/encryption.ts";
+import { rawDb } from "../../lib/db.ts";
 import type {
   GetSettingsResponse,
   UpdateSettingsRequest,
···
         return createAuthErrorResponse(error);
       }
 
-      const body = (await ctx.req.json()) as UpdateSettingsRequest;
+      const body = (await ctx.req.json()) as UpdateSettingsRequest & {
+        instapaperPassword?: string;
+      };
+
+      // Validate Instapaper credentials if enabling or updating
+      if (
+        body.instapaperEnabled &&
+        (body.instapaperUsername || body.instapaperPassword)
+      ) {
+        // Need both username and password for validation
+        let username = body.instapaperUsername;
+        let password = body.instapaperPassword;
+
+        // If only one is provided, fetch the other from existing settings
+        if (!username || !password) {
+          const existingSettings = await getUserSettings(oauthSession.did);
+          username = username || existingSettings.instapaperUsername;
+          password = password ||
+            (await getInstapaperPassword(oauthSession.did));
+        }
+
+        if (username && password) {
+          const validation = await validateInstapaperCredentials({
+            username,
+            password,
+          });
+
+          if (!validation.valid) {
+            const result: UpdateSettingsResponse = {
+              success: false,
+              error: validation.error || "Invalid Instapaper credentials",
+            };
+            return Response.json(result, { status: 400 });
+          }
+        }
+      }
+
       const settings = await updateUserSettings(oauthSession.did, body);
       const result: UpdateSettingsResponse = { success: true, settings };
       return setSessionCookie(Response.json(result), setCookieHeader);
···
 
   return app;
 }
+
+/**
+ * Helper function to get encrypted password for validation.
+ */
+async function getInstapaperPassword(
+  did: string,
+): Promise<string | undefined> {
+  const result = await rawDb.execute({
+    sql:
+      "SELECT instapaper_password_encrypted FROM user_settings WHERE did = ?",
+    args: [did],
+  });
+
+  if (result.rows?.[0]?.[0]) {
+    try {
+      return await decrypt(result.rows[0][0] as string);
+    } catch (error) {
+      console.error("Failed to decrypt Instapaper password:", error);
+    }
+  }
+
+  return undefined;
+}

shared/types.ts

···
 // User settings (stored in database)
 export interface UserSettings {
   readingListTag: string;
+  instapaperEnabled: boolean;
+  instapaperUsername?: string; // Decrypted, only in memory (never includes password)
 }
 
 // Settings API response
···
 // Settings API update request
 export interface UpdateSettingsRequest {
   readingListTag?: string;
+  instapaperEnabled?: boolean;
+  instapaperUsername?: string;
+  instapaperPassword?: string; // Only when updating credentials
 }
 
 // Settings API update response

tests/api.test.ts

···
 import { initOAuth } from "../lib/oauth-config.ts";
 
 // Initialize OAuth with test URL before running tests
-initOAuth("https://kipclip.com");
+initOAuth(new Request("https://kipclip.com"));
 
 // Create handler from app
 const handler = app.handler();

tests/bookmarks.test.ts

···
 } from "./test-helpers.ts";
 
 // Initialize OAuth with test URL
-initOAuth("https://kipclip.com");
+initOAuth(new Request("https://kipclip.com"));
 const handler = app.handler();
 
 // Store original fetch

tests/encryption.test.ts

···
+/**
+ * Tests for encryption utilities.
+ * Verifies encryption/decryption with mocked environment.
+ */
+
+import { assertEquals, assertNotEquals, assertRejects } from "@std/assert";
+import { decrypt, encrypt } from "../lib/encryption.ts";
+
+// Set test encryption key
+Deno.env.set(
+  "ENCRYPTION_KEY",
+  "test-encryption-key-for-unit-tests-only-minimum-32-chars",
+);
+
+Deno.test("encrypt - encrypts plaintext to base64 string", async () => {
+  const plaintext = "my-secret-password";
+  const ciphertext = await encrypt(plaintext);
+
+  // Should be base64 encoded
+  assertEquals(typeof ciphertext, "string");
+  assertNotEquals(ciphertext, plaintext);
+
+  // Should contain IV + ciphertext (at least 16 bytes base64)
+  assertEquals(ciphertext.length > 16, true);
+});
+
+Deno.test("decrypt - decrypts ciphertext back to plaintext", async () => {
+  const plaintext = "my-secret-password";
+  const ciphertext = await encrypt(plaintext);
+  const decrypted = await decrypt(ciphertext);
+
+  assertEquals(decrypted, plaintext);
+});
+
+Deno.test(
+  "encrypt - produces different ciphertext each time (random IV)",
+  async () => {
+    const plaintext = "my-secret-password";
+    const ciphertext1 = await encrypt(plaintext);
+    const ciphertext2 = await encrypt(plaintext);
+
+    // Different IVs should produce different ciphertexts
+    assertNotEquals(ciphertext1, ciphertext2);
+
+    // But both should decrypt to same plaintext
+    assertEquals(await decrypt(ciphertext1), plaintext);
+    assertEquals(await decrypt(ciphertext2), plaintext);
+  },
+);
+
+Deno.test("decrypt - throws on invalid ciphertext", async () => {
+  await assertRejects(
+    async () => await decrypt("invalid-base64!@#"),
+    Error,
+  );
+});
+
+Deno.test("encrypt/decrypt - handles special characters", async () => {
+  const plaintext = "pässwörd with spëcial chàrs! 🔐";
+  const ciphertext = await encrypt(plaintext);
+  const decrypted = await decrypt(ciphertext);
+
+  assertEquals(decrypted, plaintext);
+});
+
+Deno.test("encrypt/decrypt - handles empty string", async () => {
+  const plaintext = "";
+  const ciphertext = await encrypt(plaintext);
+  const decrypted = await decrypt(ciphertext);
+
+  assertEquals(decrypted, plaintext);
+});

tests/instapaper.test.ts

···
+/**
+ * Tests for Instapaper API client.
+ * Uses mocked fetch to avoid external dependencies.
+ */
+
+import { assertEquals } from "@std/assert";
+import {
+  sendToInstapaper,
+  validateInstapaperCredentials,
+} from "../lib/instapaper.ts";
+
+// Mock fetch responses
+function createMockFetch(
+  responses: Map<string, Response>,
+): typeof fetch {
+  return (
+    input: RequestInfo | URL,
+    _init?: RequestInit,
+  ): Promise<Response> => {
+    const url = typeof input === "string" ? input : input.toString();
+
+    for (const [pattern, response] of responses) {
+      if (url.includes(pattern)) {
+        return Promise.resolve(response.clone());
+      }
+    }
+
+    return Promise.resolve(new Response("Not Found", { status: 404 }));
+  };
+}
+
+Deno.test("sendToInstapaper - success returns true", async () => {
+  const originalFetch = globalThis.fetch;
+  globalThis.fetch = createMockFetch(
+    new Map([
+      ["instapaper.com/api/add", new Response("", { status: 201 })],
+    ]),
+  );
+
+  try {
+    const result = await sendToInstapaper(
+      "https://example.com/article",
+      { username: "[e-mail]", password: "testpass" },
+    );
+
+    assertEquals(result.success, true);
+    assertEquals(result.error, undefined);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+Deno.test(
+  "sendToInstapaper - invalid credentials returns error",
+  async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = createMockFetch(
+      new Map([
+        ["instapaper.com/api/add", new Response("", { status: 403 })],
+      ]),
+    );
+
+    try {
+      const result = await sendToInstapaper(
+        "https://example.com/article",
+        { username: "wrong", password: "wrong" },
+      );
+
+      assertEquals(result.success, false);
+      assertEquals(result.error, "Invalid Instapaper credentials");
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  },
+);
+
+Deno.test("sendToInstapaper - includes title in request", async () => {
+  const originalFetch = globalThis.fetch;
+  let capturedUrl = "";
+
+  globalThis.fetch = (input: RequestInfo | URL): Promise<Response> => {
+    capturedUrl = input.toString();
+    return Promise.resolve(new Response("", { status: 201 }));
+  };
+
+  try {
+    await sendToInstapaper(
+      "https://example.com/article",
+      { username: "test", password: "test" },
+      "Test Article Title",
+    );
+
+    assertEquals(capturedUrl.includes("title=Test+Article+Title"), true);
+  } finally {
+    globalThis.fetch = originalFetch;
+  }
+});
+
+Deno.test(
+  "validateInstapaperCredentials - valid returns true",
+  async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = createMockFetch(
+      new Map([
+        ["instapaper.com/api/authenticate", new Response("", { status: 200 })],
+      ]),
+    );
+
+    try {
+      const result = await validateInstapaperCredentials({
+        username: "[e-mail]",
+        password: "testpass",
+      });
+
+      assertEquals(result.valid, true);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  },
+);
+
+Deno.test(
+  "validateInstapaperCredentials - invalid returns false with error",
+  async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = createMockFetch(
+      new Map([
+        ["instapaper.com/api/authenticate", new Response("", { status: 403 })],
+      ]),
+    );
+
+    try {
+      const result = await validateInstapaperCredentials({
+        username: "wrong",
+        password: "wrong",
+      });
+
+      assertEquals(result.valid, false);
+      assertEquals(result.error, "Invalid username or password");
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  },
+);

tests/settings.test.ts

···
 import { createMockSessionResult } from "./test-helpers.ts";
 
 // Initialize OAuth with test URL
-initOAuth("https://kipclip.com");
+initOAuth(new Request("https://kipclip.com"));
 const handler = app.handler();
 
 Deno.test("GET /api/settings - returns 401 when not authenticated", async () => {
···
     assertExists(body.error);
   },
 });
+
+Deno.test({
+  name: "PATCH /api/settings - accepts Instapaper settings",
+  async fn() {
+    // Mock successful credential validation
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = () => Promise.resolve(new Response("", { status: 200 }));
+
+    try {
+      setTestSessionProvider(() =>
+        Promise.resolve(createMockSessionResult({ pdsResponses: new Map() }))
+      );
+
+      const req = new Request("https://kipclip.com/api/settings", {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          instapaperEnabled: true,
+          instapaperUsername: "[e-mail]",
+          instapaperPassword: "testpassword",
+        }),
+      });
+      const res = await handler(req);
+
+      assertEquals(res.status, 200);
+      const body = await res.json();
+      assertEquals(body.success, true);
+      assertEquals(body.settings.instapaperEnabled, true);
+      assertEquals(body.settings.instapaperUsername, "[e-mail]");
+      // Password should never be returned
+      assertEquals(body.settings.instapaperPassword, undefined);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  },
+});
+
+Deno.test({
+  name: "PATCH /api/settings - validates Instapaper credentials",
+  async fn() {
+    // Mock failed credential validation
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = () => Promise.resolve(new Response("", { status: 403 }));
+
+    try {
+      setTestSessionProvider(() =>
+        Promise.resolve(createMockSessionResult({ pdsResponses: new Map() }))
+      );
+
+      const req = new Request("https://kipclip.com/api/settings", {
+        method: "PATCH",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          instapaperEnabled: true,
+          instapaperUsername: "[e-mail]",
+          instapaperPassword: "wrongpass",
+        }),
+      });
+      const res = await handler(req);
+
+      assertEquals(res.status, 400);
+      const body = await res.json();
+      assertEquals(body.success, false);
+      assertExists(body.error);
+    } finally {
+      globalThis.fetch = originalFetch;
+    }
+  },
+});