API Token Takeaways
Back around early August we started requiring that Pinball Map API users include a token in their data requests. Read about that here. Now that it’s been in place for three months, we’ll share some thoughts, lessons, and takeaways.
We received a lot of requests. We’re somewhere around 150 right now. We approved the vast majority of them. Nearly every request that we did not approve was because the request didn’t include the details that we asked to be included (we note in the automated denial message that this is probably the reason).
The request process was also a great opportunity for us to audit how existing API users were using and showing our data. That’s not something we had kept up with very well, simply because we didn’t have a record of who was using it. But now we do and can more easily monitor usage.
That provided an opportunity to refine our data attribution. What we came up with is that individual location listings should link to that exact location on Pinball Map (rather than a general link to the home page - or rather than just a single general link tucked away on some other screen). This way, users are more likely to visit the listing and update it if needed. The goal is to make sure the map gets updated, so that all this data everyone is using remains useful.
Other interesting things:
- LLMs have made it so that people can simply make a custom “fork” of an existing service. No coding skills needed. Like, if a high score or tournament app doesn’t have a feature they want, they just make their own high score or tournament app.
- Lots of people are making high score and tournament apps. And also machine rules apps, and tracking the machines I’ve played apps.
- LLMs have made reviewing the token requests a bit of a burden, because they write a ton and then we humans have to read it. We normally have a 100% response rate to messages sent to us. But a couple of these are just too much… plus, some are likely to be a fly-by-night idea that the person dumps on us and then forgets about.
Overall, the token requirement was a success. API usage is much more balanced and manageable. Our server resources are steady. We have direct lines of communication with all API users.