ACLED rejects API Key

[afalk42]

Variant

worldmonitor.app (Full / Geopolitical)

Affected area

Settings / API keys

Bug description

I signed up for an ACLED account and generated an API Key as per the instructions here: https://acleddata.com/api-documentation/getting-started
However, when I provide either the Access Token or the CSRF Token in the Setting dialog, I get the message:
Failed: ACLED_ACCESS_TOKEN: ACLED rejected this token
I was able to get 13 out of 15 API Keys set up correctly, but both ACLED and Wingbits did not work.

Steps to reproduce

Go to settings
Enter ACLED Access Token
Click on OK

Expected behavior

The token should be accepted and the application should be able to use it.
However, what confuses me is that the instructions at https://acleddata.com/api-documentation/getting-started clearly say that both an Access Token and a Refresh Token are needed, because the Access Token is only valid for 24 hours.

Screenshots / Console errors

No response

Browser & OS

MacOS app v2.5.6

[SebastienMelki]

Thanks for the report. Looked into the code — here's what's happening:

How ACLED auth works

ACLED uses an OAuth 2.0 token flow, not a simple API key. The steps are:

1. POST to https://acleddata.com/oauth/token with your email, password, grant_type=password, and client_id=acled
2. You get back an access token (valid 24 hours) and a refresh token (valid 14 days)
3. The access token goes in the settings field — that's what we send as Authorization: Bearer <token>

What's likely going wrong

• If you entered the CSRF token from the ACLED dashboard page, that won't work — it needs to be the OAuth access token from step 2
• If you generated the access token but waited before entering it, it may have already expired (24-hour TTL)
• The "Access Token" shown in some ACLED UI pages may not be the same as the OAuth bearer token

Known limitation

Even if validation passes, the access token expires every 24 hours. We don't currently implement the refresh token flow, so the key will silently stop working after a day. This is a real gap we need to address — either by:

• Storing the refresh token and auto-refreshing
• Storing email+password and re-authenticating periodically
• Switching to cookie-based auth

To test right now

You can generate a fresh token via curl:

curl -X POST https://acleddata.com/oauth/token \
  -d "username=YOUR_EMAIL&password=YOUR_PASSWORD&grant_type=password&client_id=acled"

Copy the access_token from the response and paste it into settings immediately.

[SebastienMelki]

@koala73 FYI — the ACLED auth is OAuth-based with 24h token expiry, which is a known gap. We'll update the docs to clarify the token flow and look into implementing auto-refresh.

[koala73]

Yeah
I never got one to test
The implementation is theorical

[SebastienMelki]

Yeah I never got one to test The implementation is theorical

Okay if this is a needed feature we'll plan it, we can flesh it out here before a PR.