ekke
486480eda6
Since about 28 August 2026 CARTO stamps an "API KEY REQUIRED" watermark into every basemaps.cartocdn.com tile requested without a key. The request still returns HTTP 200, so nothing fails — Carto Light and Carto Dark simply started drawing the watermark over the map. Both layers now build their tile URL through cartoTileUrl(), which appends ?key=. The parameter name matters: api_key= is silently ignored and returns the same watermarked tile as no key at all, so a wrong guess looks right until the map is looked at. Verified by checksum that the URLs the map generates return the clean tiles for both styles. The key comes from VITE_CARTO_API_KEY in .env.local, which is git-ignored, so it is not in the source and rotating it is a configuration change; .env.example documents the variable. If it is missing, a console warning says so rather than leaving only a watermark to explain it. The key is inlined into the built bundle in dist/ and sent with every tile request, so it is visible to anyone using the application. That is expected for a tile key; the exposure is quota, not access. Cached watermarked tiles are not a concern: the Service Worker keys tiles by full URL including the query string, so keyed URLs are fetched fresh and the old entries age out. No Service Worker bump — HTML is network-first, so the new bundle is picked up without one, and a bump would delete every offline tile cache (flagged separately). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
9 lines
438 B
Plaintext
9 lines
438 B
Plaintext
# Copy to .env.local (git-ignored) and fill in. Vite reads VITE_-prefixed
|
|
# variables at build time and inlines them into the bundle.
|
|
|
|
# CARTO basemaps (Carto Light, Carto Dark). Since late August 2026 CARTO stamps
|
|
# an "API KEY REQUIRED" watermark into every tile requested without a key — the
|
|
# request still succeeds, so a missing key shows up only as the watermark.
|
|
# Free key: https://carto.com/basemaps/apikey
|
|
VITE_CARTO_API_KEY=
|