Oath2 support to overcome exposed API Key?

I did raise that concern with OS when the new APIs came out. They thought it was unlikely to be a problem in practice but that there is always OAuth.

In order to get the OAuth token, the mapping javascript would have to send a request to the WordPress server which would in turn use its stored credentials to request the token and return it to the client. Normally you would require the WordPress server to check who is making the request before going to the OS API to get the token, typically by checking that the user is logged in. But in most applications the website viewer is not logged in, so the server would have to accept anonymous requests. That puts you back to square one because anyone can use your endpoint to request an OAuth token and use it in their own map requests.

If you have any good ideas on how to make this work better then I may be able to look at implementing something.

Thanks so much for the reply – no ideas here I’m afraid. I had hoped OS would allow endpoint url restriction on the API (like google do) as that seems like a relatively straightforward way to secure it. But no!