Perfect guys!
That’s right what i need.
Thanks a lot.
I have just one more question.
To explain a situation first :
We have on one side discourse forum, and on the other FE application, where we show some of the topics,
and also allow users to comment on topics.
Until now all communication was through our BE, so if i want to create a topic, or comment on it, we had a method on our BE, which will do that job with main API_KEY and also with user who has admin privileges.
The idea now is to avoid all of those communication through BE, and directly create posts and make comments from client side. That’s why i asked is it possible to create api_key for specific user.
Now the question, finally, is this ok from security perspective?
So when i create api_key for specific user, that api_key will have rights like that user has on forum,
because that api_key will be exposed on client side?
Main goal is to get rid of communication through BE, at least some of it (creation of users and other sensitive stuff will still remain on BE side).
But creating posts and replying to them, we still want to be doable by users. So api_key will be used from client side.
So do you suggest to do something like this?
Thanks a lot.
and keep up with good work!