Browser and server keys, key expiry and a per-visitor limit

API keys now come in two kinds, browser (um_pk_) and server (um_sk_), with an optional expiry date and a per-visitor request limit on browser keys, so a key shipped in page code cannot be drained by one scraper.

• Create a browser key (um_pk_) for page code, limited to the origins you list, or a server key (um_sk_) that never leaves your server. The kind is fixed at creation.
• A key can carry an expiry date. After it, requests get 401 key_expired and are not metered.
• A browser key can limit each visitor to 300, 1,200 or 4,800 requests per minute, counting tiles, glyphs and sprites. New browser keys start at 1,200; existing ones have no limit until you set one, and No limit stays a choice for keys behind busy shared networks.