Can non-admin user issue their own API key?

You need to add the domain (and path) to the allowed user api auth redirects site setting.

If you’re manually issuing HTTP requests, then discourse://auth_redirect should work.