I think there are two things going on. For one, the login/authentication between mediawiki and tinyRSS is not working. The api comes back with a message "You need read permission to use this module". I would be interested to know how to troubleshoot that... I don't know how to view what is going on there.

The second problem is, though, that the RSS feeder can't interpret that error as a feed and so let me know what is wrong. I don't think what comes back is formatted as a feed. Maybe I am naive, but it seems to me that a request for an RSS feed would best be countered with a "you can't have it because..." as an RSS feed. Does that make sense?

I am looking into the TinyRSS side of things.

MediaWiki 1.24.0
PHP 5.5.21 (cgi-fcgi)
MySQL 5.6.22-cll-lve

TinyRSS forums got back saying that for an authenticated feed listing to work, "http basic/digest auth" needs to be supported and that "digest authentication requires curl". Does Mediawiki work like that?

No, MediaWiki does not use basic authentication. You can use cookies if you want.

Did you check if you can still access your personal watchlist feed - from Special:Watchlist

This one uses a special token so you can bypass login.

If I understand correctly what you might need is to have a kind of token that creates a custom recent changes link for you to bypass login.

@csteipp what do you think? Shall we provide an additional 'feed' token for API feedrecentchanges and feedcontributions modules? I think re-using existing watchlist or patrol tokens is not an option?

If RSS feeds from mediawiki are to be accessible from a feed reader that is web based then cookies won't do the trick but a token would. To me, being accessible from multiple devices is one of the main benefits of a feed aggregator, so this would be a good feature.

I eventually used the work-around in https://phabricator.wikimedia.org/T76528. In our case the wiki is pretty low-key so I am not too concerned opening it up like that, especially since you still need to log on to read articles. A token would likely be better. Or at least a setting that allows me to change this preference in localsettings.

It seems like TinyRSS should use OAuth to consume the feed as the user in this case. I have no idea if they have a dev community that can implement that. I don't like the idea of expanding our watchlist tokens to be more generic. But obviously if there is strong demand for that, then I can look into the security of it more.

@JTannerWMF: If this is not MediaWiki-Recent-changes, which software project tag should be associated to this task?