Heartbeat ping returns OK even when I use a made-up token

Verify on the MonoDuty side rather than from the response. Two ways: 1. Open the heartbeat in the dashboard right after sending a test ping and look at the last ping timestamp. If it just updated, your token is correct. If it is unchanged or empty, the token is wrong. 2. Open the heartbeat's status history. Every ping writes an event there, success or failed, with a timestamp. This is also where you would spot a pattern of failures. A practical tip for your rollout: do this verification once per heartbeat at setup time, then never worry about it again. A typo in the token is a setup-time mistake, it does not appear later on its own. One more thing since you are testing: only GET and POST are routed for check-ins. If your tooling sends HEAD or PUT you will get a method not allowed response, which unlike a bad token is a visible error.