verapli
Sign inJoin free
Menu

Guides · maps · Popular APIs

Mapbox account and access tokens

Create a Mapbox account, add a payment method to lift trial limits, and create scoped public (pk) and secret (sk) access tokens, optionally URL-restricted, for maps, search and navigation APIs.

Researched · not yet run liveLast researched 25 October 2026 · Mapbox · provider site

Researched, not yet run live. Built from the provider’s official pages (linked below). A person hasn’t walked this flow end to end yet, so check each step against the source.
Do this with verapliJSON for agents

Who owns what

One Mapbox account (username) owns tokens, usage and billing. Tokens belong to the account and carry scopes.

  • Mapbox account developer owned by you or your organisationCard-free sign-up gives a trial account with one token and monthly caps.
  • Payment method on the account billingoptional · under Mapbox accountNeeded for full free tiers, token management (create, rotate, delete) and permanent geocoding.

Mapbox says that without a card on file it cannot verify account ownership, so a card-less account with 2FA enabled cannot be recovered by support.

Have ready

  • An email address you can verify within 24 hours: The confirmation link sent at sign-up expires after 24 hours.
  • A list of the web origins (domains) that will load your maps, if you plan to URL-restrict tokens
  • A credit or debit card for the Mapbox account · Trial (card-free) accounts cannot create, rotate or delete tokens and have low monthly caps; permanent geocoding needs a card on file. [3]Needed for: Add a payment method

Steps

Steps marked “human step” are ones only you can do: verapli never signs in, submits, pays or accepts terms for you.

  1. Create a Mapbox account

    You sign up on the Mapbox account page, choosing either "Start without a credit card" (trial) or adding a card. You accept the terms and press create yourself.

    • Guided by hand
    • Human step: You press submit

    Where: https://account.mapbox.com/auth/signup/

  2. Verify your email

    Open the confirmation email from Mapbox and click the link; you then land in the Mapbox Console.

    • Guided by hand
    • Human step: You sign in
    • After: Create a Mapbox account
    The provider says
    The confirmation link is valid for 24 hours. [3]
    If something goes wrong (1)
    • The confirmation link has expired: Request a new confirmation email from the sign-in page [to verify exact flow]. [3]

  3. Add a payment methodoptional

    In the Console billing area, you add a card. This removes trial caps, raises rate limits and enables token management. Usage beyond the free tiers is billed monthly. Skip this only for a small prototype.

    • Guided by hand
    • Human step: You add payment details
    • After: Verify your email

  4. Copy the default public token

    Every account has a default public token with all public scopes. It cannot hold secret scopes or URL restrictions. Fine for local development; create dedicated tokens for production.

    • verapli co-pilot
    • After: Verify your email

    verapli captures MAPBOX_ACCESS_TOKEN here by plain code: encrypted in your browser, never shown to AI.

    Where: https://console.mapbox.com/account/access-tokens/

  5. Create a URL-restricted public token for productionoptional

    Create a new public (pk) token with only the public scopes you need and add your site URLs as restrictions (up to 100, no wildcards or IPs; add localhost explicitly if needed). Mobile SDK apps cannot use URL restrictions.

    • verapli co-pilot
    • After: Add a payment method

    verapli captures MAPBOX_PUBLIC_TOKEN here by plain code: encrypted in your browser, never shown to AI.

    If something goes wrong (1)
    • Map requests fail with 403 Forbidden after adding URL restrictions (403): Make sure the page sends a Referer header (not noreferrer or same-origin policy), the URL is listed exactly (paths are case-sensitive), and GL JS is 0.53.1 or later. [1]

    Where: https://console.mapbox.com/account/access-tokens/

  6. Create a secret token for server-side useoptional

    Create a secret (sk) token with only the secret scopes you need (e.g. uploads, or tokens:write to mint tokens via the Tokens API). It is shown only once, so store it in a secrets manager straight away. Use it only from a server.

    • verapli co-pilot
    • After: Add a payment method

    verapli captures MAPBOX_SECRET_TOKEN here by plain code: encrypted in your browser, never shown to AI.

    Where: https://console.mapbox.com/account/access-tokens/

Terms and gotchas

Plain-English summary, not legal advice. Each card links its source.

Can cost moneyThe rules say

Temporary geocoding results cannot be cached

Default (temporary) Geocoding API results may not be cached or stored. Storing results needs permanent geocoding (permanent=true), which needs a card on file or an enterprise contract and has no free tier. Geocoding responses may only be used with a Mapbox map. [8]

Can cost moneyThe rules say

Mapbox logo and text attribution are required

The Mapbox logo must stay visible on any map using Mapbox designs, data or software (it can be moved, not removed or styled). Maps using Mapbox styles or data must show text attribution linking © Mapbox, © OpenStreetMap and Improve this map. [7]

Can cost moneyThe rules say

You pay for anyone who uses your token

You are responsible for all activity under your account, including key use whether or not authorised. Public tokens in web pages are visible to anyone; Mapbox calls URL restrictions a best-effort mitigation. [6]

Worth knowingThe rules say

No extra accounts to dodge the free tier

The terms forbid creating multiple accounts to avoid exceeding the monthly free usage credits. [6]

Worth knowingThe rules say

Secret tokens are shown once

A secret token's value is displayed only at creation; store it immediately or rotate it. [1]

What you end up with

Env varSecretFormatWhat it is
MAPBOX_ACCESS_TOKENnot secretpk.…Default public token (all public scopes, no URL restrictions)
MAPBOX_PUBLIC_TOKENnot secretpk.…Dedicated, URL-restricted public token for production web maps
MAPBOX_SECRET_TOKENsecretsk.…Secret token with secret scopes, for server-side calls only

Pricing

  • Free tier: With a payment method, monthly free tiers per product, e.g. 50,000 Mapbox GL JS map loads, 25,000 mobile SDK MAU, 100,000 temporary geocoding requests, 100,000 Directions requests. Card-free trial accounts have lower caps (e.g. 5,000 GL JS map loads, 10,000 Directions requests).
  • Costs: Pay-as-you-go beyond free tiers with automatic volume discounts; permanent geocoding has no free tier. See pricing page for rates.
  • Trial accounts lack Raster Tiles API and permanent geocoding until a payment method is added.

Source [5]

For agents

The same entry as JSON: /api/v1/entries/mapbox/access-tokens · requirements /api/v1/requirements/mapbox/access-tokens · terms /api/v1/terms/mapbox/access-tokens.

Remote MCP (read-only, no auth)
claude mcp add --transport http verapli https://verapli.com/mcp

> "What do I need for Mapbox account and access tokens, and how long will it take?"
  → tools/call requirements { "provider_id": "mapbox/access-tokens" }

Sources

  1. Mapbox – Access tokens guide pk/sk/tk token types; default public token; scopes; secret tokens shown once; URL restriction limits (100 URLs, referer needed, no wildcards, no mobile SDKs, localhost must be added); rotation steps; trial accounts cannot create, rotate or delete tokens · accessed 25 October 2026 · official
  2. Mapbox – Tokens API reference Tokens API endpoints and tokens:read / tokens:write scopes; temporary tokens max one hour, cannot be revoked or URL-restricted; 100 requests per minute per account; HTTPS only · accessed 25 October 2026 · official
  3. Mapbox – Sign up with Mapbox Card-free trial sign-up with 24-hour email verification; trial monthly caps (e.g. 5,000 GL JS map loads, 10,000 Directions requests); adding a payment method removes caps and enables token management · accessed 25 October 2026 · official
  4. Mapbox – Settings and account access Without a card on file Mapbox cannot verify account ownership, so support cannot restore a card-less account with 2FA enabled · accessed 25 October 2026 · official
  5. Mapbox – Pricing Monthly free tiers per product (e.g. 50,000 GL JS map loads, 100,000 temporary geocoding requests); permanent geocoding has no free tier; automatic volume pricing · accessed 25 October 2026 · official
  6. Mapbox – Terms of Service Each API request must include one of your account's keys; you are responsible for all key use; no multiple accounts to stay under free usage credits; do not remove proprietary notices · accessed 25 October 2026 · official
  7. Mapbox – Attribution requirements Mapbox logo required and cannot be removed or styled; text attribution with © Mapbox, © OpenStreetMap and Improve this map links when using Mapbox styles or data · accessed 25 October 2026 · official
  8. Mapbox – Geocoding API Temporary geocoding results may not be cached; permanent results (permanent=true) may be stored and need a card on file or enterprise contract; Geocoding API responses only for use with a Mapbox map · accessed 25 October 2026 · official

Provider rules change. This page is generated from verapli registry version 2026.1025.387; spotted something out of date? Tell us. Mapbox is not affiliated with verapli.