Bot accounts | Wikipedia 2.0

What a bot is

A bot is a separate account that you own and that a script uses instead of your own account. It has its own profile page, its own change proposals and its own rate limits, so automation never acts in your name.

Every signed-in user can create bots. A bot cannot create other bots.

Create a bot

Open Settings → Bots and choose Create bot.

Username	Always starts with @bot_. You type only the rest (1–16 letters, digits or single underscores), for example imports → @bot_imports. People cannot take usernames that start with bot_, and bots cannot drop the prefix.
How many	Up to 10 bots per user. Deleted bots do not count.
Description	Optional, up to 500 characters. Shown on the bot’s profile next to its owner.
API keys	A new bot gets one key. A bot can have 2 keys at once, so you can switch scripts to a new key before you revoke the old one.

The full key (cbk_…) is shown only once, right after it is created. Store it like a password; settings later show only its first characters. If you lose it, create a new key and revoke the old one.

Log in as the bot

Exchange the API key for an access token, then send the token as Authorization: Bearer <token> on every request. The key itself is never sent to other endpoints.

# 1. Exchange the bot's API key for tokens
curl -X POST https://wikipedia2.org/mvp2/v1/auth/bot-token \
  -H "Content-Type: application/json" \
  -d '{"apiKey":"cbk_ab12cd34_…"}'

{"accessToken":"eyJ…","refreshToken":"eyJ…","accessTokenExpiresAt":"…",
 "refreshTokenExpiresAt":"…","userActorId":"…","username":"@bot_imports"}

# 2. Call the API as the bot
curl https://wikipedia2.org/mvp2/v1/me -H "Authorization: Bearer $ACCESS_TOKEN"

# New access token without logging in again (comes back in Set-Cookie: auth_token=…)
curl -i -X POST https://wikipedia2.org/mvp2/v1/auth/renew-token \
  -H "Cookie: refresh_token=$REFRESH_TOKEN"

401	Unknown, revoked or malformed key, or the bot was deleted.
403	The bot is suspended by its owner.
429	Too many logins: 10 per minute per key, 30 per minute per IP address. Reuse the tokens instead.

Rate limits

Each bot has its own limits. GET requests count as reads; POST, PUT, PATCH and DELETE count as writes. They are sized for about 20,000 imported profiles per bot per day.

Reads	600 per minute
Writes	300 per minute
Writes per day	100,000 per day (UTC)
Logins	10 per minute per key

Responses carry RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset. Over a limit the API answers 429 with Retry-After in seconds: wait that long, then continue. Retries with the same Idempotency-Key count too.

HTTP/1.1 429 Too Many Requests
Retry-After: 17
RateLimit-Limit: 300
RateLimit-Remaining: 0
{"error":"bot rate limit: 300 write requests per minute"}

Review and profile

Edits made by a bot go through the usual review, exactly like edits by people. The owner’s standing does not carry over to the bot.

A bot’s profile shows a Bot badge and “Operated by @owner” right under its name, with its description. The owner’s profile lists the bots they operate.

Suspend, revoke, delete

In Settings → Bots you can suspend a bot (it cannot log in or call the API until you enable it again), revoke a key, or delete the bot. Each of these also ends the bot’s current sessions, so its tokens stop working within a minute.

Deleting a bot frees its place among your 10 bots. Its profile and its edits stay, so history keeps an author.

Your bots on your change proposals page

Your change proposals page has an Accounts column on the left: “Manual (own account)” for what you did yourself, and every bot you own or used to own, deleted bots included. Each one shows how many change proposals it made for the current type and date filters, and the column adds up the ones you pick.

Tick the accounts to see their change proposals in one list, newest first. Bots never change owner, so a bot’s edits always count towards the person who created it.

API headers (Idempotency-Key, dry run, X-Bot-Version) →Bot automation keys →← Documentation