# Allow API use by regular users, not just admins

**URL:** https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724
**Category:** Development
**Tags:** rest-api
**Created:** [February 10, 2023, 2:14am UTC](https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724 "2023-02-10T02:14:35Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![ClawdiaWolf](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/clawdiawolf/32/262518_2.png) [@ClawdiaWolf](https://meta.discourse.org/u/ClawdiaWolf)
#### Post date: [February 11, 2023, 3:00am UTC](https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724/4 "2023-02-11T03:00:35Z")

</div>

That response is incorrect. Any user can generate a user API key if the generation of user API keys is enabled for the user’s trust level. If you don’t set a redirect in the request payload it will display a base64 encoded response in the browser that contains the key.

See [this topic](https://meta.discourse.org/t/generate-user-api-keys-for-testing/145744) for a script that shows how it is done.

---

_[View the full topic](https://meta.discourse.org/t/allow-api-use-by-regular-users-not-just-admins/254724)._