Auth for scripts and CI after API key removal (personal access tokens) – tracking and use cases
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 8/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- scala
- Domain
- api, authentication
Research direction
The payload names no source files, tests or entry points, only the API key removal in v4.11.0 and the /api/v2/challenge/{id}/rebuild endpoint. Start by reading the linked MapRoulette incident post and the code that disabled API keys to see how authentication is currently handled. This is a tracking issue for personal access tokens, so there is no patch to write yet; done means an agreed design for token creation, expiry and scopes.
Written by the indexing model from the issue text.
Description
Context: https://community.openstreetmap.org/t/maproulette-security-incident-october-2026/148566
Since v4.11.0 API keys are disabled, so scripts that call the API get HTTP 401. The incident report says they will be replaced by personal access tokens (shown once, revocable, with an expiry). I could not find an issue for that yet, so this one is meant as a place to subscribe and to collect the workflows that depend on it.
My use case: scheduled challenge rebuilds
osm-schulabgleich compares official school data with OpenStreetMap and publishes two MapRoulette challenges (56330 and 56332) from hosted GeoJSON feeds (remoteGeoJson). After each data refresh a GitHub Actions workflow calls
/api/v2/challenge/{id}/rebuild?removeUnmatched=true&skipSnapshot=true
with the API key from a repository secret. This now fails with 401: https://github.com/osmberlin/osm-schulabgleich/actions/runs/37882747042
My possible Workaround for now is to rebuilding both challenges by hand on maproulette.org after each refresh.
I have the same workflow for the campaigns that are promoted via https://radinfra.de/kampagnen/. The trigger happens in tilda-geo.
What would help for this kind of workflow
- A token that works in a request header from a non-browser client, with no cookie or interactive login.
- A lifetime long enough for scheduled jobs, or a way to renew without a daily manual step. A visible expiry date and a reminder before it runs out would help.
- If tokens get scopes: one limited to managing my own challenges (rebuild, update) would be enough here. It would not need access to user data or task completion.
- Dominant language
- Scala
- Stars
- 53
- Forks
- 39
- Avg merge
- 9h 24m
- Merged PRs (30d)
- 2
Getting set up
- Ships a Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from maproulette/maproulette-backend
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
maproulette/maproulette-backend#1087 ·
-
Difficulty 5/5 Over a week Newbie friendliness 12/100
maproulette/maproulette-backend#1289 · 3 comments ·
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 45/100
maproulette/maproulette-backend#1258 · 1 comment ·
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
maproulette/maproulette-backend#1198 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 42/100
maproulette/maproulette-backend#1192 · 3 comments ·
All issues in maproulette/maproulette-backend
Similar issues
-
AI Auto-validate
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
ProjectSidewalk/SidewalkWebpage#5788 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 78/100
scalameta/metals-zed#99 ·
-
area:ops priority:P2 status:idea
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
KD5UJC-XYZ/scarab#112 ·
-
Bound wrong-magic P2P diagnostics to parsed header bytesPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
ergoplatform/ergo#2736 ·
Maintainers usually reply within 1 day
-
perf: use extend when buffering partition row indices in the native shuffle writerPossibly taken @HarshilMital claimed this today. Openarea:shuffle enhancement good first issue performance requires-triage
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
apache/datafusion-comet#7072 · 2 comments · 1 assignee ·
Maintainers usually reply within 1 day