CartoDB Table and Visualization Privacy Settings and "Uncaught Error: sql is read-only in NamedMaps"

Question

I developed an application using cartodb.js, and I made a duplicate table/database to reference (and updated my table name, layer URL, and API key references in my code). With this new table, the app gives the following error when the layer is added to the map (after it displays the layer on the map – which surprised me): ”Uncaught Error: sql is read-only in NamedMaps”.

Previously I had been using a table and a visualization that had a “Only visible to people with the link” (orange lock icon) privacy setting for both. I was able to perform read queries (SELECT SQL statements) to the table/layer without the need for an API Key and had no errors returned. I only had to use my API Key when using INSERT, UPDATE, and DELETE SQL statements.

With the new table and visualization, I have the same privacy settings specified: “Only visible to people with the link”. But now, it gives the “Only visible to people with the link” error when I try to do a SELECT SQL query using sublayers[0].setSQL( “SELECT …”).

Two questions:

1. Shouldn’t I be able to do SELECT SQL queries with a visualization and its table set to a privacy setting of “Only visible to people with the link”?
2. If I choose to make my table and/or visualization “Private” (red lock icon), I presume I can execute SQL queries using ` $.getJSON(“http://username.cartodb.com/api/v2/sql?q=SELECT...&api_key=12”)`. But, how do perform `sublayers[0].setSQL( “SELECT …”)` calls? (Wouldn't I need to include an API Key?)

Answer 1

Complementing @javisantana answer:

• Private tables require the API Key to perform ANY SQL query on them.
• Public with link and public tables need the API Key to perform UPDATE, INSERT and/or DELETE SQL queries on them, but not for SELECT SQL queries.

Answer 2

1) If some of the tables in the visualization is private you will not be able to change the SQL. There is no way to change SQL or CartoCSS on visualizations with some data private on them. The reason is pretty clear: the data in the table could be leaked

If all the tables in your visualization are public, please, send the visualization so we can review what's happening, it could be a bug in our side

2) Using API KEY from javascript code is in most of the cases wrong: if you want people access to a table just make it public. If you provide the API any user could remove your tables. There is some more info about this here https://github.com/CartoDB/cartodb.js/issues/56