mapbox / mapbox/mapbox-gl-js

Using Temporary Access Tokens

Open
#12,623 4 comments 1 reaction 0 assignees View on GitHub
needs information :pray:
Dominant language
TypeScript
Stars
12.4k
Forks
2.4k
PR merge metrics
No merged PRs in 30d

Description

**mapbox-gl-js version**:

### Question
**Is it possible to update the access token that a map is using while that map is rendered?**

I have been tasked with ensuring there are no long-lived access tokens that are used within our front end code. I have been able to set up a system to fetch a new temporary Mapbox access token each time our app is visited which allows the user to load the map which works as expected.

However the maximum time that these temporary access tokens can be valid (so far as I can find) is 1 hour. After that token expires then no new section of the map can be loaded as the calls to the Mapbox api fail.

My plan was to watch for an error on the onError method of the map and when errors related to an unauthenticated token arise I could then fetch a new temporary access token and use that instead.

The problem is I have not been able to find a way to update which access token the map uses.

Overall my question is
- **Is there a correct way to use temporary access tokens to display a map, or is the only officially supported way to use the long lived access tokens?**
- **If temporary tokens are not meant to be used in this way do you know of any workarounds that would allow me to do this?**

Thank you for any advice, I have been working on this for a few weeks now so I thought it would be best to ask here. Let me know if there is any other information I can provide to help out with this question

### Links to related documentation
Temporary Token generation: https://docs.mapbox.com/help/tutorials/get-started-tokens-api/

Contributor guide

Open the contributing guide

Research direction

Start with the map's onError handling and the temporary-token documentation linked in the issue. Determine whether a rendered map can accept a refreshed token after expiry and document the supported approach or limitation. Done means the temporary-token workflow and token-refresh behavior are clearly documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, typescript
Domain
authentication, frontend, web-dev
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.