Cursemeta API broken

[Ionaru]

It looks like, for newer mod versions, the Cursemeta API used by this program does not work anymore.
For example mod Sophisticated Backpacks (422301) version 1.18.2-3.16.1.579 (3793584): https://cursemeta.dries007.net/422301/3793584.json

Moving to the official Curse API (CF Core) might be the only option.
That API needs an API key however, this may need to be added as a config option in server-setup-config.yaml.
The API response is also different from Cursemeta, but the required information is all there.

CurseMeta

curl https://cursemeta.dries007.net/378646/3683708.json -H 'Accept: application/json'

Curse API

curl https://api.curseforge.com/v1/mods/378646/files/3683708 -H 'Accept: application/json' -H 'x-api-key: MY_API_KEY'

API keys can be created here: https://console.curseforge.com/?#/api-keys

[itsdinkd]

CFCore is for game development, for third party applications (Server-start) you would need to apply for the API Key. Which can be found here, https://forms.monday.com/forms/dce5ccb7afda9a1c21dab1a1aa1d84eb?r=use1

This was taken from Curseforge's dev discord

tos: https://support.curseforge.com/en/support/solutions/articles/9000207405-curse-forge-3rd-party-api-terms-and-conditions

[Ionaru]

Does that mean it only needs a single API key for the whole application, or does every user need to create their own?

[BloodWorkXGaming]

Yes, I am aware that it will break at one point entirely, it was only a matter of time. It seems like that point is coming closer.

As you've already said an API-Key is necessary for downloading mods now, which is quite problematic for an open source tool like this.
It would be awesome to have a public API-Key for ServerStarter, however, this is sadly impossible. Nothing could prohibit the misuse of this API-Key which is linked to me and my name.
Furthermore, reading the Terms of Services for this increases the problem, as legal actions could be filed for excessive use.

Until curseforge provides a way to download mods without an key, the only options remaining are either letting curseforge downloads die and use full serverpack downloads provided by the authors or allowing the user to supply his own API-Key.

This problem is sadly not only affecting ServerStarter but also MultiMC and many other alternative launchers.
If anyone has another idea of how to solve this problem I would be happy to hear it.

[FederAndInk]

hmm, seems like PolyMC already got around this, see PolyMC/PolyMC#557 and PolyMC/PolyMC#585
and it seems they are using an API key, but they might have less traffic, so I don't know if it's a potential solution

[brumoen]

Until curseforge provides a way to download mods without an key, the only options remaining are either letting curseforge downloads die and use full serverpack downloads provided by the authors or allowing the user to supply his own API-Key.

IMO, just expose a setting for the API key and make it so that users of the script needs to make their own API key.
Not a problem at all, if someone wants to use the script they just need to get an API key.

[CKY-]

Furthermore, reading the Terms of Services for this increases the problem, as legal actions could be filed for excessive use.

This would not be an issue if in the settings you include a way for us users to supply our own key as brumoen has mentioned.
Any service provider would have to supply their own keys or anyone installing the server itself.

[itsdinkd]

Until curseforge provides a way to download mods without an key, the only options remaining are either letting curseforge downloads die and use full serverpack downloads provided by the authors or allowing the user to supply his own API-Key.

IMO, just expose a setting for the API key and make it so that users of the script needs to make their own API key. Not a problem at all, if someone wants to use the script they just need to get an API key.

Problem with this is, and this is in my perspective as a modpack developer who uses server start for my modpacks, the api key that I provide will be exposed still when my users download my server pack and get server start.

[itsdinkd]

If curseforge gave PolyMC a key, wouldn't they give serverstart one? Maybe they will know it will be publicly exposed or would ToS still come into play even knowing this?

[CKY-]

Until curseforge provides a way to download mods without an key, the only options remaining are either letting curseforge downloads die and use full serverpack downloads provided by the authors or allowing the user to supply his own API-Key.

IMO, just expose a setting for the API key and make it so that users of the script needs to make their own API key. Not a problem at all, if someone wants to use the script they just need to get an API key.

Problem with this is, and this is in my perspective as a modpack developer who uses server start for my modpacks, the api key that I provide will be exposed still when my users download my server pack and get server start.

that's just it you dont supply a key you make anyone who wants to use it get there own.

[itsdinkd]

Until curseforge provides a way to download mods without an key, the only options remaining are either letting curseforge downloads die and use full serverpack downloads provided by the authors or allowing the user to supply his own API-Key.

IMO, just expose a setting for the API key and make it so that users of the script needs to make their own API key. Not a problem at all, if someone wants to use the script they just need to get an API key.

Problem with this is, and this is in my perspective as a modpack developer who uses server start for my modpacks, the api key that I provide will be exposed still when my users download my server pack and get server start.

that's just it you dont supply a key you make anyone who wants to use it get there own.

This defeats the purpose of accessibility. I've learned that curseforge has set up the keys they give out, like the one they gave PolyMC, do not fall under ToS. Highly recommend Bloody chat with CF.

[BloodWorkXGaming]

I tested it with curseforge API and ran into a much bigger problem: mods that disallow third party downloads.

Not even the polyMC key can download/get downloadlinks for those.
For those mods there are two options: the modpack author integrates them in the server pack or the serverstarter opens a browser, where the user can download it.
Sadly Autodownloading those won't work, as is protected by a cloud flare captcha.
However this is only an option for local installations, but not remote headless ones with only ssh access.

[brumoen]

I tested it with curseforge API and ran into a much bigger problem: mods that disallow third party downloads.

Not even the polyMC key can download/get downloadlinks for those. For those mods there are two options: the modpack author integrates them in the server pack or the serverstarter opens a browser, where the user can download it. Sadly Autodownloading those won't work, as is protected by a cloud flare captcha. However this is only an option for local installations, but not remote headless ones with only ssh access.

An option for this with headless would be to list failed mods at the end of the installation process with URL's to manually download them, and instructions on where to place them when downloaded locally and uploaded to the server and then tell the script to continue the installation process.

[Ocraftyone]

A HOPEFUL SOLUTION

So, I was doing a bit of research into the CF client (aka surfing reddit), and it turns out that it too uses the CFCore API. So then, how does it get the files for the mods that are not publicly available through the API? A whitelisted API key hidden in the curseforge client! So, if you want to experiment with this, I have a fork that uses the CFCore API in place of the (RIP) cursemeta API, and that will allow you to provide an API key within the config. You can use this with a legit CFCore API key and it will download all of the mods it can, but you can also use this hidden key to return normal functionality.

Huge cudos to this repo for finding this:

Full instructions and the fork will be here.