Mapbox Token Security
If you're using Mapbox and wondering whether that token should be pk.* or sk.*, or if URL restrictions actually matter, this breaks it down clearly. It covers the three token types, scope management by use case, and the storage patterns that prevent you from accidentally committing secrets. The rotation and incident response references are thorough enough to hand to a team lead. Honestly, the checklist format makes it more useful than Mapbox's own docs for the "am I doing this securely?" question. Good for onboarding, code review, or that moment when you realize a secret token made it into a React bundle.
- skills.sh installs
- 2K
- GitHub stars
- 86
- last updated
- Aug 21, 2026
Install
$ npx -y skills add mapbox/mapbox-agent-skills --skill mapbox-token-security --agent claude-codeInstalls into .claude/skills of the current project.
Files
Mapbox Token Security Skill
This skill provides security expertise for managing Mapbox access tokens safely and effectively.
Token Types and When to Use Them
Public Tokens (pk.*)
Characteristics:
- Can be safely exposed in client-side code
- Limited to specific public scopes only
- Can have URL restrictions
- Cannot access sensitive APIs
When to use:
- Client-side web applications
- Mobile apps
- Public-facing demos
- Embedded maps on websites
Allowed scopes:
styles:tiles- Display style tiles (raster)styles:read- Read style specificationsfonts:read- Access Mapbox fontsdatasets:read- Read dataset datavision:read- Vision API access
Secret Tokens (sk.*)
Characteristics:
- NEVER expose in client-side code
- Full API access with any scopes
- Server-side use only
- Can create/manage other tokens
When to use:
- Server-side applications
- Backend services
- CI/CD pipelines
- Administrative tasks
- Token management
Common scopes:
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageDetails
- Repository
- github.com/mapbox/mapbox-agent-skills
- Categories
- Security, AI & Agent Building
- First seen
- May 16, 2026
More from mapbox/mapbox-agent-skills
All 18- Mapbox Search Integration1.9K
- Mapbox Search Patterns1.9K
- Mapbox Store Locator Patterns1.7K
- Mapbox Mcp Devkit Patterns1.6K
- Mapbox Ios Patterns1.5K
- Mapbox Android Patterns1.5K
- Mapbox Google Maps Migration1.5K
- Mapbox Mcp Runtime Patterns1.4K
- Mapbox Maplibre Migration1.4K
- Mapbox Location Grounding1.3K
- Mapbox Web Integration Patterns2.7K
- Mapbox Web Performance Patterns2.5K
- Mapbox Style Patterns2.4K
- Mapbox Geospatial Operations2.3K
- Mapbox Data Visualization Patterns2.2K
- Mapbox Cartography2.2K
- Mapbox Style Quality2K
Recommended
More Security
mcp-security-auditgithub/awesome-copilotAudit MCP (Model Context Protocol) server configurations for security issues. Use this skill when: - Reviewing .mcp.json files for security risks - Checking MCP1.1Kskills.sh installs
agent-security-managerruvnet/rufloAgent skill for security-manager - invoke with $agent-security-manager1.1Kskills.sh installsagent-v3-security-architectruvnet/rufloAgent skill for v3-security-architect - invoke with $agent-v3-security-architect1.1Kskills.sh installs
avast-premium-security-analysisaradotso/security-skillsavast premium security analysis947skills.sh installs