We're going to close this off, and if future IP projects that need APIs come up, we'll deal with them individually.

Looks like it's merged; all good here.

Per discussion with @daniel we think this is a good opportunity for some collaboration between the Platform team and Structured Data. I'll follow up with SD to see how to make it work.

I think there's a strong argument to be made for NEVER having an expiration on owner-only tokens, btw. Since the user and the developer are the same person, they have a lot of other ways of disabling use of the token, such as disabling the key, or... just not running their code.

In T264637#6632258, @tstarling wrote:

Would it be easier from this point to make the API call to meta on the server instead, and have a more static output page?

No, I think it's too late for that. And it doesn't seem to solve the problem, it just moves it to the server.

I added T268284 to capture the need to have a refresh mechanism for owner-only api key auth tokens. I don't think it's urgent but I wanted to make sure we remembered.

@apaskulin asked what the default expiry should be.

@Pchelolo and @Clarakosi could this be related at all to the changes we made to the JWT creation for rate limiting?