Demozoo's API keys are fair, as long as the scene's memory stays open

Is a locked door always a wall? When an archive of a whole subculture asks you to sign in before you query it, the instinct is to bristle. We think the instinct deserves a second look, because the problem here isn't the lock. It's who is rattling the handle.

What changed, in two paragraphs

Demozoo, which describes itself as the largest database of demoscene releases, events, groups and other entities, announced on its news page that "unsustainable bot traffic" is forcing it to close unauthenticated public access to its API. From November 1, or sooner if bots escalate, requests must carry an API key.

The mechanics are modest. According to the pull request that implemented it, users get an "API" item in their account menu to set up keys, and the code includes key revocation. The documentation includes advice on acceptable rate limits and a pointer to the public SQL dump. Requests made in the browser while logged in keep working, and a test endpoint lets developers check their setup before the switch.

A volunteer archive is entitled to defend itself

Read the language of that pull request and you can feel the exhaustion. The maintainer blames bot traffic and, bluntly, "AI bros". We'd soften the tone but not the diagnosis. Demozoo looks to us like a community database rather than a company with an infrastructure budget, and when automated scrapers hammer an endpoint, someone pays for that, in money, in time or in sleep. Asking for an identifiable key is, in our view, the cheapest, least intrusive tool available: it lets the maintainers see who is calling and revoke bad actors without shutting everyone out.

It is also worth noticing what they did not do. They did not remove the API or hide the data. The key is attached to an ordinary account, and the documentation points to a public SQL dump, which suggests bulk access remains a path for people who need the whole thing. In our view, that detail matters more than the key itself.

The cost lands on the small tools, and that's where openness is tested

The first people to feel this are probably hobbyists, not bot farms. Take the community project livecode.demozoo.org. Its maintainers noted in an issue that its update command calls the API whenever it meets an unknown scener or party ID, and that contributors running it locally would each need their own key in a local config file. If they also want the automated deployment to cope with outdated cache files, a key would have to be stored as a repository secret too. A pull request covering the local part was opened and merged within a couple of days.

That is a small tax, and it was paid quickly. Apple2TS, an emulator project, also merged support for Demozoo key authentication on October 21, ahead of the deadline. These are the kinds of tools that make a demo archive useful rather than merely stored: emulators that launch productions, indexes that connect them to live-coding sessions. Their quick adaptation suggests the community is willing to play along.

But goodwill is not a policy. The documentation we have doesn't tell us what the terms of use will be, whether keys will ever be limited or refused, or how researchers doing legitimate large-scale work should proceed. We won't guess. We will say what we'd want.

What we'd ask of Demozoo, and of everyone else

First, keys should stay free and instant for anyone with an account. The moment a key requires justification or approval, a safety measure turns into a gatekeeper. Second, the terms should be written down plainly: what rate is fine, what counts as abuse, what happens if you cross the line. Third, the SQL dump should stay public and current, because it is the honest answer to anyone who wants everything without hammering a live server.

And the rest of us have a job as well. If you maintain a tool that touches Demozoo, update it now and test against the auth endpoint. Use the dump for bulk work. Cache what you fetch. The scene's collective memory is a commons, and commons survive when users take less than the maximum.

Our verdict: this looks like a proportionate response to a real threat, not a fence around the scene's history. Judge Demozoo by what it does next. If the keys stay free and the rules stay clear, this will probably be remembered as a footnote. If not, we'll be the first to say so.