API app / key not working anymore?

[nettum]

Hi!

I've been getting watch history using trakt-api-version 2 with a my client id as trakt-api-key since September 20th, 2024 and it's been working flawlessly, but now it seems like I'm getting http 403.
When I go to "Your API Apps" I do not see any apps (I don't remember if this is where I created the API key, but I guess so).

My app is not working anymore and when I test manually using bruno with the same client id I also get 403.
Have my api app / key been removed? Have something changed on your side?

I can ofc provide more info if needed.

[nettum]

I just created a new app and changed to the new client id and it started working again.
My app is caching all (successful) API calls and have minimal with traffic, so it should not be related to something like "extremely abnormal API usage" as stated in #689.

Any reason the app has been revoked / deleted without any warning or information?

[kevincador]

Hey there,

Could you please provide more details about your integration? Did it run daily or only occasionally? Is it something you’re using personally or a publicly available app?

It’s possible that your app was flagged as suspicious for no apparent reason. We’re trying to shield the API from unfair usage, but we’re still working on the best way to do it.

[nettum]

It runs max 2 requests per hour (episodes and movies history), but since this is a personal website it's probably just a few times a day.

If the key was flagged, should there be not some kind of alterting / notifications?
An app deactivation and an email instead of deleted app(?) and non-working key anymore.

I can ofc unserstand if we're talking about abuse / huge amount of calls, but I can't really see how that may have gone down.

As I said I've created a new app, so this is not an issue for me anymore, but might be worthwhile finding out why it suddently stopped working?
Thanks for checking it out!

[kevincador]

You can use the new API key you just created, yes. Given the information I have, I don't see any reason why the problem would come up again.

Could you share your old API key by mail support@trakt.tv mentioning this conversation with me (Kevin)? I'll check why the app was deleted in the first place and get back to you as soon as I know.

[SAMDCB10]

Eyy how you doing guys, i think i got the same problem, i am not sure if what you talking is the way that i have to go, but can you tell me what i can do?

[kevincador]

@SAMDCB10 this may not be the same issue. I've joined the conversation here.

[SAMDCB10]

alright thanks very much, ill be up to date in the forum that you send me,

[nta7]

Hi!

I seem to be having the same issue. I have been using the API since 2021 with no issues. Only recently I have started to get HTTP 403 responses. Interestingly, this behavior appears to be inconsistent: some requests still work perfectly fine with the same API key (maybe this has something to do with Cloudflare serving cached 200 responses?).

If I go to the "Your API apps" page, it shows up empty:

My app isn't publicly available, it has a total of 4 users. I'm reviewing every workflow, but so far I haven't identified any point where it may be constantly hitting the API rate limits. Would it be possible to check if there was a specific case of API abuse that may have triggered this deletion? I'd like to rule out any issue with the client code before creating a new API key.

[kevincador]

To all:
if you had your API app deleted, can you tell me if you were only doing un-authenticated requests?
Other way to ask: were you using an OAuth flow to log users (or yourself) in?

[jonathanantoine]

(Side note : My users seems to face the same issue but my app's are still on my account page.)

[nettum]

Was not using oauth, was just using the client id as a header "trakt-api-key": process.env.TRAKT_CLIENT_ID

[nta7]

Same here. My app only uses un-authenticated GET methods, sending the client id in the trakt-api-key header.

[virtualrapha]

Had the exact same issue. Publicly available app (free), only doing un-authenticated requests (providing trakt-api-key, but no OAuth flow).

[kevincador]

We found the root cause of this issue. It was caused by a new process that cleans up API apps that appear to be inactive. The issue is that the activity is measured by active sessions (which means at least one logged in user via OAuth).

I'm going to update the public documentation and see if we can add a note on the application creation page to make this clear.

If you have been affected by this:

• create a new app (you'll have a new API key and secret)
• make sure you implement and have at least one active session every 6 months