DaniGA, a regular Discourse user, wants to connect specific forum categories to Discord via Zapier but is unable to authenticate using API keys provided by the admin. Despite sharing documentation, the keys fail with an error during Zapier setup. simon explains that the issue arises because Zapier validates connections via a route (/topics/private-messages/<username>) that requires a Single User API key with Global permissions — even though the key is limited to the user’s own permissions and cannot be misused. DaniGA thanks simon for the clarification, which provides a clear path forward: the admin must generate a Global-permission Single User API key for them. While this solution is technically safe, admins may still hesitate due to policy or security concerns. No tutorial is provided in the thread, but simon includes a screenshot illustrating how the admin should configure the key.
I am a regular user in a Discourse forum who wants to receive posts from certain categories on my Discord using Zapier. I asked the site admin for the key/user key with read permissions and he gave me a couple but none of them worked. I get this message when log in to Discourse from Zapier.
I already send him some official resources like User API keys specification but there has been no success. Is this something I can do? or do I need to be an admin? what could be going wrong? Is there a tutorial on how to generate the user API key correctly?
This can be made to work, but the site’s admin will need to generate a Single User API key for you that is set to allow Global permissions. The reason that Global permissions are requires is because Zapier makes an API request to /topics/private-messages/<username> to validate the connection between Discourse and Zapier. This route can only be accessed with a Global API key.
Here’s an example of how an admin could create that API key for your user:
A single user API key with global permissions can only be used to perform actions that the user the key has been created for has permissions to perform on the site. That means that the key could not be used in a malicious way. That said, the site admins may have concerns about generating this type of API key for you.
