# API CORS Headers Incorrect

**URL:** https://meta.discourse.org/t/api-cors-headers-incorrect/135155
**Category:** Support
**Created:** [December 5, 2019, 2:19pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155 "2019-12-05T14:19:04Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![david](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/david/32/157490_2.png) [@david](https://meta.discourse.org/u/david)
#### Post date: [January 23, 2020, 12:42pm UTC](https://meta.discourse.org/t/api-cors-headers-incorrect/135155/3 "2020-01-23T12:42:35Z")

</div>

We have two different API authentication systems, which can be confusing.

> [@jessicat](#):
>
> “API-Key” and “Api-Username”

These are for the ‘admin API’, which is described on [docs.discourse.org](http://docs.discourse.org). This is not designed to be used from javascript clients.

> [@jessicat](#):
>
> “User-API-Key”, “User-Api-Client-Id”

These are from the “User API” specification, which can be used from a javascript client (and therefore supports CORS). There are more details about this here: [User API keys specification](https://meta.discourse.org/t/user-api-keys-specification/48536)

---

_[View the full topic](https://meta.discourse.org/t/api-cors-headers-incorrect/135155)._