Summary
During the 1.6.2 E2E supplemental run, uploads via the Imgur (anonymous) store consistently failed with HTTP 403 from https://api.imgur.com/3/image, even though the request body and headers conform to the documented base64 form-encoded contract (Authorization: Client-ID <id>, Content-Type: application/x-www-form-urlencoded, image=<b64>&type=base64).
The same client_id used to work; Imgur appears to have rate-limited / banned widely-shared anonymous client_ids that ship inside open-source apps. This is a known industry-wide pattern — Imgur has been progressively tightening anonymous API access.
Repro
- Configure the plugin with the default bundled
IMGUR anonymous client_id.
- Run "Image Upload Toolkit: Publish page" on any note containing a local image.
- Observe
ApiError surfaced in the progress modal; network log shows 403 Forbidden from Imgur.
Body verified correct via Batch 8 fix (#71 — base64 form body for requestUrl).
Hypotheses
- Imgur has revoked or rate-limited the bundled anonymous client_id.
- Imgur now blocks anonymous uploads from non-browser User-Agents entirely.
- IP-level throttling on shared CI / cloud egress.
Options
- Document only: mark anonymous mode as best-effort in README; recommend users register their own client_id and paste it in settings.
- Remove bundled client_id: force users to provide their own; eliminates the false-bad-UX of a non-working default.
- Switch to authenticated OAuth flow: significantly more complex, but the only Imgur-supported long-term path.
- Deprecate Imgur anonymous store: surface a settings warning and stop advertising it.
Recommendation
Start with (1) + (2): drop the bundled client_id, update README + settings UI copy to point users at https://api.imgur.com/oauth2/addclient to register their own. Revisit OAuth if there's demand.
Refs
Summary
During the 1.6.2 E2E supplemental run, uploads via the Imgur (anonymous) store consistently failed with HTTP 403 from
https://api.imgur.com/3/image, even though the request body and headers conform to the documented base64 form-encoded contract (Authorization: Client-ID <id>,Content-Type: application/x-www-form-urlencoded,image=<b64>&type=base64).The same client_id used to work; Imgur appears to have rate-limited / banned widely-shared anonymous client_ids that ship inside open-source apps. This is a known industry-wide pattern — Imgur has been progressively tightening anonymous API access.
Repro
IMGURanonymous client_id.ApiErrorsurfaced in the progress modal; network log shows403 Forbiddenfrom Imgur.Body verified correct via Batch 8 fix (#71 — base64 form body for
requestUrl).Hypotheses
Options
Recommendation
Start with (1) + (2): drop the bundled client_id, update README + settings UI copy to point users at https://api.imgur.com/oauth2/addclient to register their own. Revisit OAuth if there's demand.
Refs
src/uploader/imgur/imgurAnonymousUploader.ts