Trello responds 'invalid key'

Question

I am trying to get JSON data for a Trello board using the following URL, using Node.js's https module:

https://trello.com/b/nC8QJJoZ.json

Here's my code:

var https = require('https');

https.get('https://trello.com/b/nC8QJJoZ.json', function (res) {
    console.log('statusCode:', res.statusCode);
    console.log('headers:');
    console.log(res.headers);
    res.setEncoding('utf8');

    res.on('data', function (chunk) {
        console.log(chunk);
    });
}).on('error', function (e) {
    console.log('ERROR: ' + e);
});

Although the URL works perfectly in browser, It returns a body containing the string "invalid key", with a 401 status. Following is the output:

statusCode: 401
headers:
{ 'cache-control': 'max-age=0, must-revalidate, no-cache, no-store',
  'x-content-type-options': 'nosniff',
  'strict-transport-security': 'max-age=15768000',
  'x-xss-protection': '1; mode=block',
  'x-frame-options': 'DENY',
  'x-trello-version': '1.430.0',
  'x-trello-environment': 'Production',
  'set-cookie':
   [ 'dsc=ae78a354044f982079cd2b5d8adc4f334cda679656b3539ee0adaaf019aee48e; Path=
     'visid_incap_168551=/NYMaLRtR+qQu/H8GYry1BCKl1UAAAAAQUIPAAAAAAC1zWDD1JLPowdC
     'incap_ses_218_168551=+/2JSB4Vz0XJO/pWbX4GAxCKl1UAAAAA0pAbbN5Mbs4tFgbYuskVPw
  expires: 'Thu, 01 Jan 1970 00:00:00',
  'content-type': 'text/plain; charset=utf-8',
  'content-length': '12',
  etag: 'W/"c-b1ec112"',
  vary: 'Accept-Encoding',
  date: 'Sat, 04 Jul 2015 07:24:00 GMT',
  'x-iinfo': '1-11281210-11279245 PNNN RT(1435994639565 404) q(0 0 0 -1) r(3 3) U
  'x-cdn': 'Incapsula' }
invalid key

What am I doing wrong?

Answer 1

Well, it turns out that we need to provide a Trello API application key (generated from here) with our request.

var https = require('https');
var KEY = '<replace this with your app key>';

https.get('https://trello.com/b/nC8QJJoZ.json?key=' + KEY, function (res) {
    ...
});

This seems to me a weird requirement because we are not using Trello's API endpoint. (Even if I solved the problem, I would still like to know why a browser can access the resource, but a server side script cannot.)