Files
gods-eye-view/docs/opensky-auth.md
T
Sameh Khamis 60644c5f5d feat: name live feed routes and sources for what they serve
The flight, military and vessel feeds were named after the providers the
bundled server uses (/api/opensky, /api/adsblol/mil, /api/ais-live and
their track routes; createOpenSkySource, createAdsbLolSource,
createAisStreamSource). Any server should be able to answer a feed from
its own provider, so the feeds are now:

  /api/flights   /api/flights/track?icao24=
  /api/military  /api/military/track?hex=
  /api/vessels   /api/vessels/track?mmsi=

with createFlightSource, createMilitarySource and createVesselSource. The
old routes are removed. Each server names its provider in X-Feed-Source
(the bundled server sends OpenSky Network, adsb.lol and AISStream, so its
attribution is unchanged) and the military feed's cache state and age in
X-Feed-Cache and X-Feed-Age-Ms. Sources report the provider the server
names and fall back to the feed's name.
2026-10-03 23:10:32 -07:00

1.6 KiB

OpenSky Auth Setup

God's Eye View uses explicit auth modes for /api/flights:

  • OPENSKY_AUTH_MODE=oauth (default, recommended)
  • OPENSKY_AUTH_MODE=auto (OAuth first, then Basic fallback)
  • OPENSKY_AUTH_MODE=basic
  • OPENSKY_AUTH_MODE=anon

Reference: OpenSky REST API docs recommend OAuth2 Client Credentials flow.

Quick Start (OAuth Client JSON)

Import credentials from JSON (clientId/clientSecret or client_id/client_secret) into Keychain:

./scripts/opensky-import-client.sh ~/Downloads/credentials.json
# or: npm run opensky:import -- ~/Downloads/credentials.json

Then launch:

./scripts/dev-fresh.sh

Expected startup lines:

  • OpenSky auth mode: oauth
  • OpenSky OAuth: configured

Optional: Launch With File (No Keychain Import)

OPENSKY_CREDENTIALS_FILE=~/Downloads/credentials.json ./scripts/dev-fresh.sh

Launchers resolve OAuth creds in this order:

  1. OPENSKY_CLIENT_ID + OPENSKY_CLIENT_SECRET
  2. OPENSKY_CREDENTIALS_FILE
  3. Keychain (opensky-network / client_id, client_secret)

Basic Auth (Legacy)

Basic auth is still supported for now, but OpenSky is moving away from it.

OPENSKY_AUTH_MODE=basic ./scripts/dev-fresh.sh

Troubleshooting

Inspect proxy headers:

curl -si http://localhost:4173/api/flights | grep -iE 'HTTP/|X-OpenSky-Auth'

Useful reasons:

  • oauth_invalid_or_missing: OAuth client not found/usable
  • oauth_invalid_credentials: OAuth client rejected by OpenSky
  • basic_invalid_credentials: username/password rejected
  • missing_basic_creds: basic mode missing user/pass
  • rate_limited: OpenSky throttling