diff --git a/src/xrpc/mod.rs b/src/xrpc/mod.rs
index ddf24b9..0cdbeb9 100644
--- a/src/xrpc/mod.rs
+++ b/src/xrpc/mod.rs
@@ -260,19 +260,7 @@ pub async fn xrpc_get(
     let mut params = parse_query_params(&raw_query);
     let claims = xrpc_claims.identity;
 
-    // Space credential Bearer requests bypass the client-key requirement;
-    // rate-limit by the credential's sub DID instead.
-    let rate_key = if claims.is_none() {
-        if let Some(ref token) = xrpc_claims.space_credential {
-            crate::spaces::credential::peek_credential_sub(token).ok_or_else(|| {
-                AppError::Auth("invalid space credential: unable to extract sub".into())
-            })?
-        } else {
-            resolve_client_key(&state, None, &parts, &params)?
-        }
-    } else {
-        resolve_client_key(&state, claims.as_ref(), &parts, &params)?
-    };
+    let rate_key = resolve_client_key(&state, claims.as_ref(), &parts, &params)?;
 
     let lexicon = state.lexicons.get(&method).await;
 
@@ -364,19 +352,7 @@ pub async fn xrpc_post(
 
     // Space credential Bearer requests bypass the client-key requirement;
     // rate-limit by the credential's sub DID instead.
-    let rate_key = if claims.is_none() {
-        if let Some(ref token) = xrpc_claims.space_credential {
-            crate::spaces::credential::peek_credential_sub(token).ok_or_else(|| {
-                AppError::Auth("invalid space credential: unable to extract sub".into())
-            })?
-        } else {
-            return Err(AppError::Auth(
-                "XRPC procedures require DPoP authentication".into(),
-            ));
-        }
-    } else {
-        resolve_client_key(&state, claims.as_ref(), &parts, &params)?
-    };
+    let rate_key = resolve_client_key(&state, claims.as_ref(), &parts, &params)?;
 
     let lexicon = state.lexicons.get(&method).await;