[mattpodwysocki]

Problem

• A For Five dashboard ChatGPT built in a test failed with "invalid Mapbox access token".
• list_public_tokens_tool returned the right token. The model then retyped it into the page instead of copying it, and changed a character.
• That's an easy mistake with about 90 characters of base64. The model fixed it once the error was pointed out.

Change
After the recommended token, the result text now says:

• Copy the token exactly, never retyped, because one changed character makes Mapbox reject it.
• If the agent wrote it into a file and can run commands, check the copy from that file instead of retyping it:

  TOKEN=$(grep -o 'pk\.[A-Za-z0-9._-]*' index.html | head -1); curl -s "https://api.mapbox.com/tokens/v2?access_token=$TOKEN"

  The response is "code":"TokenValid" when the copy is right, and "TokenInvalid" when a character changed.

The check reads the token back from the file, so it tests what was actually written. Agents that build pages, like Codex and ChatGPT's site builder, can usually run commands.

Checked

• The Tokens API returns TokenValid for a valid token and TokenInvalid for the same token with one character changed.
• The grep pulls the whole token out of a sample mapboxgl.accessToken = "pk..." page.
• All 1249 tests, lint and typecheck pass.

Not a new tool: a separate validate-token tool would be one more tool for the model to choose between, and the agents that write files are the ones that make this mistake.

🤖 Generated with Claude Code