# Allow API use by regular users, not just admins
**URL:** https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724
**Category:** Development
**Tags:** rest-api
**Created:** [February 10, 2023, 2:14am UTC](https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724 "2023-02-10T02:14:35Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@jidanni](https://meta.discourse.org/u/jidanni)
#### Post date: [February 10, 2023, 2:14am UTC](https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724/1 "2023-02-10T02:14:35Z")
[Reverse engineer the Discourse API](https://meta.discourse.org/t/reverse-engineer-the-discourse-api/20576) says
> Anything you can do on the site you can also do using the JSON api.
Alas, [https://docs.discourse.org/](https://docs.discourse.org/)
> Some endpoints do not require any authentication, pretty much anything else will require you to be authenticated. To become authenticated you will need to create an API Key from the **admin panel**.
That’s too bad, because there are a lot of legitimate uses of the API
that regular users could make use of, not just admins.
E.g., a monthly cronjob a user might set up to download his
preferences.json instead of clicking Download in Preferences
([Backup/export/import Preferences](https://meta.discourse.org/t/backup-export-import-preferences/254597)).
I am saying that a change in the source code is needed, so soon users all over the world will be able to access the API of the local Discourse they are using, to get their personal data, etc.
---
### Author:  [@Alexander](https://meta.discourse.org/u/Alexander)
#### Post date: [February 10, 2023, 2:27am UTC](https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724/2 "2023-02-10T02:27:39Z")
> [@Reverse engineer the Discourse API](https://meta.discourse.org/t/reverse-engineer-the-discourse-api/20576):
>
> Discourse is backed by a complete JSON api. Anything you can do on the site you can also do using the JSON api. The API is documented at [docs.discourse.org](https://docs.discourse.org). You can also use the [discourse\_api](https://github.com/discourse/discourse_api) Ruby gem as a client library. However, not every endpoint is documented. To determine how to do something with the JSON API here are some steps you can follow. Example: recategorize a topic. Go to a topic and start editing a category: Open Chrome dev tools, switch to the Network tab, select …
> [@User API keys specification](https://meta.discourse.org/t/user-api-keys-specification/48536):
>
> Discourse contains a system for generating API keys per user if a very specific protocol is followed. This feature facilitates “application” access to Discourse instances without needing to involve moderators. High level description At a high level: Client (desktop app, browser plugin, mobile app) generates a private/public key pair and return url Client redirects to a route on discourse giving discourse its public key Discourse gets approval from user to use app Discourse generat…
(Allows making authenticated requests depending on the scope)
* * *
You might want to take a look at these resources, they can be very helpful 🙂
---
### Author:  [@jidanni](https://meta.discourse.org/u/jidanni)
#### Post date: [February 11, 2023, 1:13am UTC](https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724/3 "2023-02-11T01:13:10Z")
[Update openapi.yml by jidanni · Pull Request #72 · discourse/discourse\_api\_docs · GitHub](https://github.com/discourse/discourse_api_docs/pull/72#issuecomment-1426251563) says
> However, without support from admins and an approved endpoint in the user api keys site settings “regular users” still can’t just generate their own api keys.
---
### Author:  [@ClawdiaWolf](https://meta.discourse.org/u/ClawdiaWolf)
#### Post date: [February 11, 2023, 3:00am UTC](https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724/4 "2023-02-11T03:00:35Z")
That response is incorrect. Any user can generate a user API key if the generation of user API keys is enabled for the user’s trust level. If you don’t set a redirect in the request payload it will display a base64 encoded response in the browser that contains the key.
See [this topic](https://meta.discourse.org/t/generate-user-api-keys-for-testing/145744) for a script that shows how it is done.
---
### Author:  [@jidanni](https://meta.discourse.org/u/jidanni)
#### Post date: [February 12, 2023, 1:55am UTC](https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724/5 "2023-02-12T01:55:31Z")
I’m thinking for the default case where person A has installed Discourse,
and person B is just a simple user on person A’s Discourse,
and A has not changed any admin settings, could B still do much with the API?
---
### Author:  [@ClawdiaWolf](https://meta.discourse.org/u/ClawdiaWolf)
#### Post date: [February 12, 2023, 4:52am UTC](https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724/6 "2023-02-12T04:52:19Z")
The User API key generation is enabled for all users by default, and anything you can do through the web interface you can do through the API because the web interface is just a frontend to the API.
I personally use it in an extension in Chrome that keeps a running total of all my unread notifications across all the instances I have accounts on with a few exceptions.
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [February 14, 2023, 9:16pm UTC](https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724/7 "2023-02-14T21:16:39Z")
If a user has an account on a Discourse instance already they should be able to use their same cookie authentication from the browser in any non-browser api requests.
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [April 29, 2023, 8:26pm UTC](https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724/8 "2023-04-29T20:26:23Z")