# API CORS Headers Incorrect
**URL:** https://meta.discourse.org/t/api-cors-headers-incorrect/135155
**Category:** Support
**Created:** [December 5, 2019, 2:19pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155 "2019-12-05T14:19:04Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@jessicat](https://meta.discourse.org/u/jessicat)
#### Post date: [December 5, 2019, 2:19pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/1 "2019-12-05T14:19:04Z")
Hi,
I am having an issue with embedding discourse in our intranet site.
The API documentation states the discourse request requires the headers “API-Key” and “Api-Username” to authenticate and gain access to the feed. However the Pre-flight check says that “User-API-Key”, “User-Api-Client-Id” are the allowed values.
When called not through a browser this work as expected. But when calling through the browser the server is claiming it requires “User-API-Key”, “User-Api-Client-Id”.
I checked basic connection worked with PostMan this behaves as per the discourse docs
If we pass the Headers from the Docs the browser blocks the request due to Pre-flight check and gets a Access-Control-Allow-Headers CORS error.
If we pass the headers the server will accept we get a “not authorised error” because the application expects differently named values.
I have tried adding headers to the docker config but it doesn’t seem to apply. The CORS enabled and origin of ‘\*’ is in the config.
Can anyone advise?
Thanks,
Jessica
---
### Author:  [@jessicat](https://meta.discourse.org/u/jessicat)
#### Post date: [January 23, 2020, 9:34am UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/2 "2020-01-23T09:34:46Z")
Just wondering if there was any more info on the above? Is this a bug or something I’m doing wrong?
Thanks,
Jessica
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [January 23, 2020, 12:42pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/3 "2020-01-23T12:42:35Z")
We have two different API authentication systems, which can be confusing.
> [@jessicat](#):
>
> “API-Key” and “Api-Username”
These are for the ‘admin API’, which is described on [docs.discourse.org](http://docs.discourse.org). This is not designed to be used from javascript clients.
> [@jessicat](#):
>
> “User-API-Key”, “User-Api-Client-Id”
These are from the “User API” specification, which can be used from a javascript client (and therefore supports CORS). There are more details about this here: [User API keys specification](https://meta.discourse.org/t/user-api-keys-specification/48536)
---
### Author:  [@gezquinn](https://meta.discourse.org/u/gezquinn)
#### Post date: [July 4, 2020, 10:01am UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/4 "2020-07-04T10:01:39Z")
@david I’m using SSO and want to log the user out of Discourse when they log out of the app. I’m currently using the ‘admin API’ to fetch the the user ID via `/users/by-external/${id}.json` but I’m getting CORS errors - I don’t want to enable the ‘user API’ for every user just for this logout process - what do you suggest?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [July 4, 2020, 3:54pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/5 "2020-07-04T15:54:16Z")
What is making the admin api request? JavaScript in your client application?
You shouldn’t include an admin API in a JavaScript client, it means everyone using the client could gain admin access to your site.
---
### Author:  [@gezquinn](https://meta.discourse.org/u/gezquinn)
#### Post date: [July 4, 2020, 7:42pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/6 "2020-07-04T19:42:38Z")
Yeah, it’s javascript in my app. I understand. So what’s the alternative? Can I add a ‘user API’ for one user and use that to make the call for all users?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [July 4, 2020, 10:12pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/7 "2020-07-04T22:12:43Z")
If you use the user api, you should do it per-user. You should not share keys.
But the most common thing here would be to handle it on the server-side of your app. Your server can send a request using admin API keys without CORS issues, and with fewer security concerns (as long as it’s implemented safely)
---
### Author:  [@gezquinn](https://meta.discourse.org/u/gezquinn)
#### Post date: [July 4, 2020, 10:33pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/8 "2020-07-04T22:33:30Z")
Thanks @david. That’s helpful, I’ll sort it that way. Thanks again.
---
### Author:  [@gezquinn](https://meta.discourse.org/u/gezquinn)
#### Post date: [July 5, 2020, 9:09pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/9 "2020-07-05T21:09:40Z")
Hi @david, I’ve tried to implement a backend solution but when I call `https://example.com/users/by-external/{EXTERNAL_USER_ID}.json?api_key={DISCOURSE_API_KEY}&api_username=system`, the response i get is the html for the sign in page (I’m guessing it’s redirecting there). I have `login required` enabled and when I disable it, I get the correct JSON response. I want to keep that setting enabled - any ideas what’s going on?
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [July 5, 2020, 9:58pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/10 "2020-07-05T21:58:52Z")
You need to use headers for the API key and username. Check [http://docs.discourse.org/](http://docs.discourse.org/) for details.
---
### Author:  [@gezquinn](https://meta.discourse.org/u/gezquinn)
#### Post date: [July 6, 2020, 12:23am UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/11 "2020-07-06T00:23:31Z")
That sorted it, thank you again. 👍
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [June 8, 2023, 11:56am UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/13 "2023-06-08T11:56:54Z")