TrakT API returning 403 to the the DuckieTV app

[garfield69]

This is an apparent repeat of an event back in Dec 2025.
We have an re-opened the ticket for the event, please refer to SchizoDuckie/DuckieTV#1501 for details.
SchizoDuckie/DuckieTV#1501 (comment)
I thought this issue was resolved, so I am obviously interested in finding out why it has occurred again and what we may need to do to avoid a future repeat.

[garfield69]

Bad timing on this issue :-( I'm away for the next three days so I can not reply to any questions till I get back.
Hopefully you can restore access so that DuckieTV users can continue using the app.
One team member seems to think the block is targeted on the DuckieTV API key.
Back in December the block was targeting the useragent.

[kevincador]

Hey,

This block wasn’t caused by a specific endpoint or user-agent rule. It was triggered by extremely abnormal API usage with the DuckieTV API key. In December the problem was different. Same symptom (403), different root cause.

In short:

• We saw hundreds of thousands of rejected requests per hour
• Coming from only 1 or 2 users (per hour)
• Adding up to millions of bad requests in a day

That kind of traffic is far beyond normal and impacts overall API stability, so the key was blocked at the firewall level.

Given the volume involved, we can’t just lift the block without confidence the behavior is fixed. Once you’ve had a chance to investigate and confirm the root cause, we’re happy to reassess.

Just in case, this pattern usually points to:

• Very old client versions still in the wild
• Retry loops on invalid / rejected requests
• Requests missing valid user context

We don’t yet have a per-endpoint breakdowns we can share, but that’s something we’re actively working toward.

Hope you understand we have to protect the API for everyone.

[ilike2burnthing]

There's only been one release since the last issue - https://github.com/DuckieTV/Nightlies/releases

This is the UA of the new release:

DuckieTV-Standalone v202512201450 Windows NT 10.0; Win64; x64

Are you able to tell if the problematic user(s) are on an older version?

Are you able to issue a new API key, without Garfield having to reapply from scratch? My thinking being that if the issue is limited to an old version(s), then the new API key only being available to newer versions would resolve the issue.

Alternatively, could you unblock the API key but block the problematic UA instead?

[kevincador]

Are you able to tell if the problematic user(s) are on an older version?
They are probably on an older version, yes.

Are you able to issue a new API key, without Garfield having to reapply from scratch?
There's no "application" process, anyone can create a new API key. It is fast, easy and would most probably solve the issue.

Alternatively, could you unblock the API key but block the problematic UA instead?
Not something we can to do, no.

[ilike2burnthing]

Sorry, should have clarified, there's a slight complication as the original dev is no longer in the picture, and I believe the registration data was tied to them, so Garfield would presumably have to start anew - SchizoDuckie/DuckieTV#1501 (comment)

Perhaps you can clarify the concern raised there:

I could try to register the app afresh but I expect I wont be allowed to use the same app name, so i suppose I would have to call it Dtv and then alter the user agent accordingly.

[kevincador]

You should be able to give the new app the same name and you can use the same user-agent. This block is on the API Key.

You can also change them, it's not a problem, as long as the instances using that new key aren't going crazy on our API 😉

[garfield69]

Thank you kevincador for providing the info on the reason for the 403.
I have re-registered the app on Trakt, and updated the latest version of the DuckieTV app with the new api key and associated changes.
I have tested the new app to confirm access is restored.
This will force Dtv app users to update to the latest version since anything older will still be blocked ;-)

[kevincador]

Thank you 🙏