bcrypt.checkpw is CPU-bound (~1.3s per call) and was running synchronously inside the async event loop, blocking ALL concurrent requests. With 5 API keys and 10 concurrent requests, this caused ~13s delay before any handler could start.