Monthly

Audit your Mapbox tokens every month

On the 1st of each month you get a list of your tokens, with unrestricted public tokens and old ones flagged.

Runs: Monthly
Apps: Mapbox
AI: Not needed
Access: secret token with tokens:read

Send this to your assistant

Create a ClickRuntime automation: on the 1st of every month, email me all my Mapbox access tokens and flag any public token that has no URL restriction or was created more than 90 days ago.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

Mapbox access tokens end up everywhere: in a front-end bundle, a test app, a contractor's repo and a forgotten demo from two years ago. A token with no URL restrictions can be copied from a web page and used by anyone, running up a bill on your account. Teams usually discover that only when an invoice looks odd or a token turns up in a public repository.

Once a month, ClickRuntime lists the tokens on your Mapbox account, checks each token's allowed URLs and creation date, and emails you only the ones that look risky, namely tokens with no URL restrictions or tokens that are older than the age you set.

It is useful for engineering leads, agencies that manage several client accounts, and any company that has staff turnover and a growing list of tokens.

What you get out of it

Unrestricted tokens are found before abuse
A public token without URL limits can be used from any website. Seeing it in your monthly list means you can add restrictions or replace it before someone else spends your map load quota.
Surprise bills become less likely
Mapbox charges by usage, and a leaked token can generate thousands of requests overnight. Routine review of exposed tokens reduces the chance of an unexpected invoice. One review a month is far cheaper than an unexpected bill.
Old tokens get retired
A token created years ago for a prototype probably has no owner anymore. The age flag prompts someone to delete it, which shrinks the number of credentials that could ever leak.
A clean answer for security reviews
Auditors and customers ask how you manage third-party keys. A dated monthly report listing what was flagged and fixed is simple evidence of a regular process. Auditors like routine and dated evidence.
Offboarding gets safer
When a developer or contractor leaves, tokens they created often remain. A recurring list highlights tokens that nobody on the current team recognizes, so they can be rotated. Stale access is a common finding in reviews, and this keeps it from piling up.
Client accounts stay tidy
Agencies that hold access for several customers can run the review per account. Each client then gets a clear list of what was changed, which supports the trust that keeps the contract.

How it works

What happens, step by step

On the 1st of each month, ClickRuntime lists every access token on your Mapbox account.
It flags public tokens that are not limited to your own websites, and public tokens older than 90 days.
You get an email listing all your tokens, with the flagged ones marked and the reason for each.

Before it runs live

Connect Mapbox

What you get

RunsMonthly

Audit your Mapbox tokens every monthtoday, 9:00Succeeded

Email · Mapbox tokensMapbox tokens: 2 of 7 flagged ⚠ Acme store locator (pk, created 2025-11-02): no URL restriction, older than 90 days

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Run it at a different time, more or less often, or only on weekdays
Add an AI step, for example to summarize, sort or draft a reply
Add another app, for example also send it to Slack
Combine it with other Mapbox steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

token_audit_report.pyexample

from datetime import datetime, timedelta, timezone
from clickruntime import on_trigger, credentials, http, notify

USERNAME = "your-mapbox-username"

@on_trigger
def run(event):
    tokens = http.get(f"https://api.mapbox.com/tokens/v2/{USERNAME}",
                      params={"access_token": credentials.secret("MAPBOX_SECRET_TOKEN")}).json()
    cutoff = datetime.now(timezone.utc) - timedelta(days=90)
    lines, flagged = [], 0
    for t in tokens:
        issues = []
        if t["usage"] == "pk" and not t.get("allowedUrls"):
            issues.append("no URL restriction")
        if t["usage"] == "pk" and datetime.fromisoformat(t["created"].replace("Z", "+00:00")) < cutoff:
            issues.append("older than 90 days")
        flagged += bool(issues)
        lines.append(f"{'⚠ ' if issues else ''}{t.get('note') or t['id']} ({t['usage']}, created {t['created'][:10]})"
                     + (f": {', '.join(issues)}" if issues else ""))
    notify.email_me(f"Mapbox tokens: {flagged} of {len(tokens)} flagged", "\n".join(lines))
    return {"tokens": len(tokens), "flagged": flagged}

FAQ

Common questions

Does it show the secret value of my tokens?

No. The report lists token names, restrictions and creation dates, which is what is needed to judge risk. Secret values are not repeated in the email, and your Mapbox credentials are stored as secrets in ClickRuntime.

Which Mapbox tokens can be audited?

It reads the tokens available to the account whose credentials you connect, using Mapbox's token API. Tokens belonging to other Mapbox accounts, such as a client's, require that account's own credentials. Public and secret tokens are both listed by name.

How old does a token have to be to be flagged?

You choose the age limit. A common choice is 12 months, but a stricter team might use 6. Tokens older than your limit are included in the email along with any that lack URL restrictions.

What permissions does it need?

secret token with tokens:read. Nothing else in your accounts is used.

Does it need AI?

No. It runs without AI, so it doesn't use your plan's AI allowance.

How many runs does it use?

One run each time it runs (monthly). Checks that find nothing to do and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

Every 5 minutes