Since about 28 August 2026 CARTO stamps an "API KEY REQUIRED" watermark into
every basemaps.cartocdn.com tile requested without a key. The request still
returns HTTP 200, so nothing fails — Carto Light and Carto Dark simply started
drawing the watermark over the map.
Both layers now build their tile URL through cartoTileUrl(), which appends
?key=. The parameter name matters: api_key= is silently ignored and returns the
same watermarked tile as no key at all, so a wrong guess looks right until the
map is looked at. Verified by checksum that the URLs the map generates return
the clean tiles for both styles.
The key comes from VITE_CARTO_API_KEY in .env.local, which is git-ignored, so it
is not in the source and rotating it is a configuration change; .env.example
documents the variable. If it is missing, a console warning says so rather than
leaving only a watermark to explain it.
The key is inlined into the built bundle in dist/ and sent with every tile
request, so it is visible to anyone using the application. That is expected for
a tile key; the exposure is quota, not access.
Cached watermarked tiles are not a concern: the Service Worker keys tiles by
full URL including the query string, so keyed URLs are fetched fresh and the old
entries age out. No Service Worker bump — HTML is network-first, so the new
bundle is picked up without one, and a bump would delete every offline tile
cache (flagged separately).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
