diff --git a/src/util/mapbox.js b/src/util/mapbox.js
index cc4c867f797..aaced940736 100644
--- a/src/util/mapbox.js
+++ b/src/util/mapbox.js
@@ -173,6 +173,11 @@ export class RequestManager {
         urlObject.protocol = apiUrlObject.protocol;
         urlObject.authority = apiUrlObject.authority;
 
+        if (urlObject.protocol === 'http') {
+            const i = urlObject.params.indexOf('secure');
+            if (i >= 0) urlObject.params.splice(i, 1);
+        }
+
         if (apiUrlObject.path !== '/') {
             urlObject.path = `${apiUrlObject.path}${urlObject.path}`;
         }
diff --git a/test/unit/util/mapbox.test.js b/test/unit/util/mapbox.test.js
index 161ebc1db9f..aebba256595 100644
--- a/test/unit/util/mapbox.test.js
+++ b/test/unit/util/mapbox.test.js
@@ -151,6 +151,15 @@ test("mapbox", (t) => {
                 t.end();
             });
 
+            t.test('removes secure params if custom API_URL is http', (t) => {
+                config.API_URL = 'http://test.example.com/api.mapbox.com';
+                t.equal(
+                    manager.normalizeSourceURL('mapbox://one.a'),
+                    'http://test.example.com/api.mapbox.com/v4/one.a.json?access_token=key'
+                );
+                t.end();
+            });
+
             t.end();
         });