How can I obtain cookies for a user or a 'user-api-key' without requiring user interaction or browser redirects?

Development
,

AI-generated summary

In a Dev discussion titled ‘How can I obtain cookies for a user or a ‘user-api-key’ without requiring user interaction or browser redirects?’, Alexandre_Gurgel1 explains they’re building an app using Discourse solely via API to handle private messages (PMs) through MessageBus. However, their current admin API key authentication fails for MessageBus with private topics — the frontend must inject cookies or use a user-specific API key, which contradicts their goal of avoiding user interaction or redirects. NateDhaliwal seeks clarification on whether DMs (Direct Messages) are being referenced. blake notes there’s no HTTP API endpoint to create user-specific API keys or manage PM updates via polling/webhooks, suggesting MessageBus may be the only viable path — though it requires a logged-in user context. Alexandre_Gurgel1 confirms they’re working with topics of type private_message. The core issue remains: obtaining a user-specific token or cookie programmatically, without UI or redirects, to enable MessageBus access to private content.

1

I’m currently developing an application that uses Discourse only as an API. The new feature relates to PMs, where we’re using private_messages. The issue here is that we need to receive updates from these private topics (private_messages) through the MessageBus, and currently our authentication method with Username: user.username and Api-Key: admin_api_key doesn’t work exclusively for this case of MessageBus and private topics; it works for everything else.

So we need a way to obtain and inject cookies into our frontend when calling the MessageBus, or to create a ‘user-api-key’ and user instead of the api-key. But we need to do this only via API, since our backend will communicate with the Discourse backend and provision everything. The frontend will only be responsible for receiving the cookie or user-api-key and adding it to the MessageBus request.

2

I assume tbis is a typo and you’re referring to PMs? DMs are related to chat.

3

Oh cool!

There’s no HTTP API endpoint for creating UserApiKey objects for other users. The /user-api-key endpoint only creates keys for the logged-in user

Using MessageBus would be handy, but I’m not sure how to get around the authentication issues. You might need to do polling and/or rely on webhooks for when PMs are updated.

4

Yeah! The topics with archtype: private_message