The middleware redirects unauthenticated custom-domain visitors through leaflet.pub/auth_callback to hydrate an external_auth_token cookie. Bots don't hold cookies or run JS, so they never complete the handshake and end up indexing the redirect instead of the publication. Detect common crawler/social preview user agents and let them through unauthenticated. Co-authored-by: Claude <noreply@anthropic.com>