{"registry_version":"2026.1025.387","generated_at":"2026-10-25T06:27:00Z","content_sha256":"089d16f627d9365e3d0663cc8069203706d7cb23a76c332226e29686968811a5","signed":true,"signature":{"key_id":"ed25519:74ca19268e364242","algorithm":"ed25519","expires_at":"2026-11-24T06:27:09Z","expired":false,"manifest":"/registry/manifest.json"},"entry_sha256":"55b31ed2a02aa5039e80e959ef628979d7b91cde273b9d3dbb8661073139d7f8","entry":{"id":"mapbox/access-tokens","name":"Mapbox account and access tokens","vendor":"Mapbox","summary":"Create a Mapbox account, add a payment method to lift trial limits, and create scoped public (pk) and secret (sk) access tokens, optionally URL-restricted, for maps, search and navigation APIs.","aliases":["mapbox","mapbox-token","mapbox-access-token"],"category":"maps","group":"C","homepage":"https://www.mapbox.com/","docs":["https://docs.mapbox.com/accounts/guides/tokens/","https://docs.mapbox.com/api/accounts/tokens/","https://docs.mapbox.com/accounts/guides/signup/"],"status":"researched","last_verified":null,"last_researched":"2026-10-25","sources":[{"id":"mapbox-tokens-guide","url":"https://docs.mapbox.com/accounts/guides/tokens/","title":"Mapbox – Access tokens guide","accessed":"2026-10-25","supports":"pk/sk/tk token types; default public token; scopes; secret tokens shown once; URL restriction limits (100 URLs, referer needed, no wildcards, no mobile SDKs, localhost must be added); rotation steps; trial accounts cannot create, rotate or delete tokens","kind":"official"},{"id":"mapbox-tokens-api","url":"https://docs.mapbox.com/api/accounts/tokens/","title":"Mapbox – Tokens API reference","accessed":"2026-10-25","supports":"Tokens API endpoints and tokens:read / tokens:write scopes; temporary tokens max one hour, cannot be revoked or URL-restricted; 100 requests per minute per account; HTTPS only","kind":"official"},{"id":"mapbox-signup","url":"https://docs.mapbox.com/accounts/guides/signup/","title":"Mapbox – Sign up with Mapbox","accessed":"2026-10-25","supports":"Card-free trial sign-up with 24-hour email verification; trial monthly caps (e.g. 5,000 GL JS map loads, 10,000 Directions requests); adding a payment method removes caps and enables token management","kind":"official"},{"id":"mapbox-settings","url":"https://docs.mapbox.com/accounts/overview/settings/","title":"Mapbox – Settings and account access","accessed":"2026-10-25","supports":"Without a card on file Mapbox cannot verify account ownership, so support cannot restore a card-less account with 2FA enabled","kind":"official"},{"id":"mapbox-pricing","url":"https://www.mapbox.com/pricing","title":"Mapbox – Pricing","accessed":"2026-10-25","supports":"Monthly free tiers per product (e.g. 50,000 GL JS map loads, 100,000 temporary geocoding requests); permanent geocoding has no free tier; automatic volume pricing","kind":"official"},{"id":"mapbox-tos","url":"https://www.mapbox.com/legal/tos","title":"Mapbox – Terms of Service","accessed":"2026-10-25","supports":"Each API request must include one of your account's keys; you are responsible for all key use; no multiple accounts to stay under free usage credits; do not remove proprietary notices","kind":"official"},{"id":"mapbox-attribution","url":"https://docs.mapbox.com/help/getting-started/attribution/","title":"Mapbox – Attribution requirements","accessed":"2026-10-25","supports":"Mapbox logo required and cannot be removed or styled; text attribution with © Mapbox, © OpenStreetMap and Improve this map links when using Mapbox styles or data","kind":"official"},{"id":"mapbox-geocoding","url":"https://docs.mapbox.com/api/search/geocoding/","title":"Mapbox – Geocoding API","accessed":"2026-10-25","supports":"Temporary geocoding results may not be cached; permanent results (permanent=true) may be stored and need a card on file or enterprise contract; Geocoding API responses only for use with a Mapbox map","kind":"official"}],"allowed_domains":["account.mapbox.com","console.mapbox.com"],"account_model":{"summary":"One Mapbox account (username) owns tokens, usage and billing. Tokens belong to the account and carry scopes.","accounts":[{"name":"Mapbox account","kind":"developer","owned_by":"you or your organisation","required":true,"note":"Card-free sign-up gives a trial account with one token and monthly caps."},{"name":"Payment method on the account","kind":"billing","parent":"Mapbox account","required":false,"note":"Needed for full free tiers, token management (create, rotate, delete) and permanent geocoding."}],"notes":["Mapbox says that without a card on file it cannot verify account ownership, so a card-less account with 2FA enabled cannot be recovered by support."]},"prerequisites":[{"need":"An email address you can verify within 24 hours","note":"The confirmation link sent at sign-up expires after 24 hours."},{"need":"A list of the web origins (domains) that will load your maps, if you plan to URL-restrict tokens"}],"have_ready":[{"kind":"payment_card","description":"A credit or debit card for the Mapbox account","why":"Trial (card-free) accounts cannot create, rotate or delete tokens and have low monthly caps; permanent geocoding needs a card on file.","needed_for":["add-payment-method"],"auto_check":"none","source":"mapbox-signup"}],"steps":[{"id":"create-account","title":"Create a Mapbox account","summary":"You sign up on the Mapbox account page, choosing either \"Start without a credit card\" (trial) or adding a card. You accept the terms and press create yourself.","route":"guided","depends_on":[],"gate":"human_submit","url":"https://account.mapbox.com/auth/signup/","sources":["mapbox-signup"]},{"id":"verify-email","title":"Verify your email","summary":"Open the confirmation email from Mapbox and click the link; you then land in the Mapbox Console.","route":"guided","depends_on":["create-account"],"gate":"human_login","lead_time":{"official":{"text":"The confirmation link is valid for 24 hours.","source":"mapbox-signup"}},"recovery":[{"hiccup":"The confirmation link has expired","fix":"Request a new confirmation email from the sign-in page [to verify exact flow].","source":"mapbox-signup"}],"sources":["mapbox-signup"]},{"id":"add-payment-method","title":"Add a payment method","summary":"In the Console billing area, you add a card. This removes trial caps, raises rate limits and enables token management. Usage beyond the free tiers is billed monthly. Skip this only for a small prototype.","route":"guided","depends_on":["verify-email"],"gate":"human_payment","optional":true,"sources":["mapbox-signup"]},{"id":"copy-default-public-token","title":"Copy the default public token","summary":"Every account has a default public token with all public scopes. It cannot hold secret scopes or URL restrictions. Fine for local development; create dedicated tokens for production.","route":"copilot","depends_on":["verify-email"],"gate":"none","url":"https://console.mapbox.com/account/access-tokens/","capture":{"env":"MAPBOX_ACCESS_TOKEN","kind":"token"},"sources":["mapbox-tokens-guide"]},{"id":"create-public-token","title":"Create a URL-restricted public token for production","summary":"Create a new public (pk) token with only the public scopes you need and add your site URLs as restrictions (up to 100, no wildcards or IPs; add localhost explicitly if needed). Mobile SDK apps cannot use URL restrictions.","route":"copilot","depends_on":["add-payment-method"],"gate":"none","url":"https://console.mapbox.com/account/access-tokens/","recovery":[{"hiccup":"Map requests fail with 403 Forbidden after adding URL restrictions","code":"403","fix":"Make sure the page sends a Referer header (not noreferrer or same-origin policy), the URL is listed exactly (paths are case-sensitive), and GL JS is 0.53.1 or later.","source":"mapbox-tokens-guide"}],"capture":{"env":"MAPBOX_PUBLIC_TOKEN","kind":"token"},"optional":true,"sources":["mapbox-tokens-guide"]},{"id":"create-secret-token","title":"Create a secret token for server-side use","summary":"Create a secret (sk) token with only the secret scopes you need (e.g. uploads, or tokens:write to mint tokens via the Tokens API). It is shown only once, so store it in a secrets manager straight away. Use it only from a server.","route":"copilot","depends_on":["add-payment-method"],"gate":"none","url":"https://console.mapbox.com/account/access-tokens/","capture":{"env":"MAPBOX_SECRET_TOKEN","kind":"secret"},"optional":true,"sources":["mapbox-tokens-guide","mapbox-tokens-api"]}],"outputs":[{"name":"MAPBOX_ACCESS_TOKEN","description":"Default public token (all public scopes, no URL restrictions)","secret":false,"example_format":"pk.…","environments":["development","test"],"from_step":"copy-default-public-token"},{"name":"MAPBOX_PUBLIC_TOKEN","description":"Dedicated, URL-restricted public token for production web maps","secret":false,"example_format":"pk.…","environments":["staging","production"],"from_step":"create-public-token"},{"name":"MAPBOX_SECRET_TOKEN","description":"Secret token with secret scopes, for server-side calls only","secret":true,"example_format":"sk.…","environments":["development","staging","production"],"from_step":"create-secret-token"}],"terms_notes":[{"kind":"rules_say","severity":"amber","title":"Temporary geocoding results cannot be cached","text":"Default (temporary) Geocoding API results may not be cached or stored. Storing results needs permanent geocoding (permanent=true), which needs a card on file or an enterprise contract and has no free tier. Geocoding responses may only be used with a Mapbox map.","source":"mapbox-geocoding"},{"kind":"rules_say","severity":"amber","title":"Mapbox logo and text attribution are required","text":"The Mapbox logo must stay visible on any map using Mapbox designs, data or software (it can be moved, not removed or styled). Maps using Mapbox styles or data must show text attribution linking © Mapbox, © OpenStreetMap and Improve this map.","source":"mapbox-attribution"},{"kind":"rules_say","severity":"amber","title":"You pay for anyone who uses your token","text":"You are responsible for all activity under your account, including key use whether or not authorised. Public tokens in web pages are visible to anyone; Mapbox calls URL restrictions a best-effort mitigation.","source":"mapbox-tos"},{"kind":"rules_say","severity":"yellow","title":"No extra accounts to dodge the free tier","text":"The terms forbid creating multiple accounts to avoid exceeding the monthly free usage credits.","source":"mapbox-tos"},{"kind":"rules_say","severity":"yellow","title":"Secret tokens are shown once","text":"A secret token's value is displayed only at creation; store it immediately or rotate it.","source":"mapbox-tokens-guide"}],"pricing_notes":{"free_tier":"With a payment method, monthly free tiers per product, e.g. 50,000 Mapbox GL JS map loads, 25,000 mobile SDK MAU, 100,000 temporary geocoding requests, 100,000 Directions requests. Card-free trial accounts have lower caps (e.g. 5,000 GL JS map loads, 10,000 Directions requests).","costs":"Pay-as-you-go beyond free tiers with automatic volume discounts; permanent geocoding has no free tier. See pricing page for rates.","notes":"Trial accounts lack Raster Tiles API and permanent geocoding until a payment method is added.","source":"mapbox-pricing"},"stripe_projects":false,"api_provisioning":{"available":"partial","notes":"Account creation and payment are human-only. Once you hold a token with tokens:write, the Tokens API can list, create, update (including allowedUrls) and delete tokens, and mint temporary tk tokens (max 1 hour, not revocable). A new token cannot have more scopes than the token creating it. Limit 100 requests/minute.","docs":["https://docs.mapbox.com/api/accounts/tokens/"],"source":"mapbox-tokens-api"},"notes":["Console token page URL (console.mapbox.com/account/access-tokens/) [to verify]; docs refer to the Access Tokens page of the Mapbox Console.","Exact Product Terms (PDF) were not read; caching and attribution notes come from the Geocoding API and attribution docs.","Rotation is create new, deploy, then delete old; deleted tokens stop working at once for uncached requests, but cached responses may persist."]}}