# Can't generate multiple API keys?
**URL:** https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011
**Category:** Feature
**Created:** [October 10, 2014, 1:31pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011 "2014-10-10T13:31:27Z")
**Posts on this page:** 19
**Page:** 1
### Author:  [@downey](https://meta.discourse.org/u/downey)
#### Post date: [October 10, 2014, 1:31pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/1 "2014-10-10T13:31:28Z")
I have an API key for my WordPress instance, but also would like to create a second API key for a [Google Drive form](https://meta.discourse.org/t/any-kind-of-data-input-also-anonymous-through-google-forms/21008). However, when I go to `/admin/api` I see buttons to regenerate my existing key or revoke it, but no option to create an additional key. Is this a UI oversight or by design?
---
### Author:  [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [October 10, 2014, 2:45pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/2 "2014-10-10T14:45:26Z")
When we designed the API key stuff we didn’t really consider that people might want to have multiple API keys for the same account.
I think this is something we should correct, as there is totally a valid use case to give different API keys to different services. It’s not a simple change though unfortunately.
---
### Author:  [@stefanm](https://meta.discourse.org/u/stefanm)
#### Post date: [December 1, 2016, 10:17am UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/3 "2016-12-01T10:17:16Z")
I see that it is old topic, but i couldn’t find new one, so i will just ask here.
I know that you guys introduced multiple API keys, and they can be added from discourse UI for specific user.
The question is, is it possible to generate api\_key for specific user on its creation, or any time after, but not from the UI.
I want to give api\_key to user with the API, with main api\_key.
Thanks!
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [December 1, 2016, 10:59am UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/4 "2016-12-01T10:59:52Z")
> [@stefanm](#):
>
> The question is, is it possible to generate api\_key for specific user on its creation, or any time after, but not from the UI.
That is definitely doable in a plugin.
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [December 1, 2016, 12:30pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/5 "2016-12-01T12:30:17Z")
> [@stefanm](#):
>
> is it possible to generate api\_key for specific user on its creation, or any time after, but not from the UI.I want to give api\_key to user with the API, with main api\_key.
You can generate an API key for a user with this API call:
```
Request URL:http://localhost:3000/admin/users/4/generate_api_key
Request Method:POST
Request Body:
api_key,
api_username
```
The response json will look like:
```
{
"api_key": {
"id": 2,
"key": "630f51d28da39e969eaf26060687449df5ba443b517167a7ae393549a168bdb3",
"user": {
"id": 4,
"username": "discourse2",
"avatar_template": "/letter_avatar_proxy/v2/letter/d/4af34b/{size}.png"
}
}
}
```
---
### Author:  [@stefanm](https://meta.discourse.org/u/stefanm)
#### Post date: [December 1, 2016, 12:59pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/6 "2016-12-01T12:59:20Z")
@blake @zogstrip
Perfect guys!
That’s right what i need.
Thanks a lot.
I have just one more question.
To explain a situation first :
We have on one side discourse forum, and on the other FE application, where we show some of the topics,
and also allow users to comment on topics.
Until now all communication was through our BE, so if i want to create a topic, or comment on it, we had a method on our BE, which will do that job with main API\_KEY and also with user who has admin privileges.
The idea now is to avoid all of those communication through BE, and directly create posts and make comments from client side. That’s why i asked is it possible to create api\_key for specific user.
Now the question, finally, is this ok from security perspective?
So when i create api\_key for specific user, that api\_key will have rights like that user has on forum,
because that api\_key will be exposed on client side?
Main goal is to get rid of communication through BE, at least some of it (creation of users and other sensitive stuff will still remain on BE side).
But creating posts and replying to them, we still want to be doable by users. So api\_key will be used from client side.
So do you suggest to do something like this?
Thanks a lot.
and keep up with good work!
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [December 1, 2016, 1:08pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/7 "2016-12-01T13:08:35Z")
Probably should still funnel all front-end requests to your back-end first, then use the appropriate api\_key for the user and have the back-end make the api call to discourse.
If you do want to keep in all on the front-end, I would generate a new discourse\_api key every time the user logs in to your app. You will also have to setup CORS on discourse to accept the requests from your front-end.
You could also implement SSO (single-sign-on) so your users could just use discourse directly without having to login again.
---
### Author:  [@stefanm](https://meta.discourse.org/u/stefanm)
#### Post date: [December 1, 2016, 1:18pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/8 "2016-12-01T13:18:31Z")
we are using SSO, and basically both (discourse and FE) are on the same server, so no need for CORS, but still i was not able to create post without api\_key, so i thought it is safer to use api\_key of specific user.
Are you saying that there is a method for creating post without using api\_key?
If i am sso logged in to discourse, of course
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [December 1, 2016, 1:29pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/9 "2016-12-01T13:29:56Z")
> [@stefanm](#):
>
> Are you saying that there is a method for creating post without using api\_key?If i am sso logged in to discourse, of course
No. I was just suggesting that they leave your app and use the actual discourse forum to make the post if they are already logged into it.
---
### Author:  [@stefanm](https://meta.discourse.org/u/stefanm)
#### Post date: [December 1, 2016, 1:38pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/10 "2016-12-01T13:38:01Z")
yes, but it is not that easy 🙂
anyway, if the api\_key, has only rights like that user on the forum?
than this option is acceptable.
because with that api\_key user can’t do much.
but if that api\_key has the same rights like admin, than we should avoid it.
---
### Author:  [@stefanm](https://meta.discourse.org/u/stefanm)
#### Post date: [December 2, 2016, 8:27am UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/11 "2016-12-02T08:27:47Z")
this was more like a question?
what rights specific user api\_key has?
admin or that specific user rights?
Thanks
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [December 2, 2016, 11:58am UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/12 "2016-12-02T11:58:13Z")
> [@stefanm](#):
>
> what rights specific user api\_key has?
the exact same rights that that user would have if they were logged into discourse.
---
### Author:  [@stefanm](https://meta.discourse.org/u/stefanm)
#### Post date: [December 2, 2016, 12:17pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/13 "2016-12-02T12:17:01Z")
perfect!
right what i need.
Thanks again!
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [December 2, 2016, 12:39pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/14 "2016-12-02T12:39:20Z")
If I remember correctly, there are a few exceptions, like being exempt from some rate limiting – maybe a team member (@sam?) can clarify this?
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [December 2, 2016, 1:07pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/15 "2016-12-02T13:07:34Z")
I think there are some specific api number of requests rate limits, but I would think these user limits would be hit first:
---
### Author:  [@blake](https://meta.discourse.org/u/blake)
#### Post date: [December 3, 2016, 12:56pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/16 "2016-12-03T12:56:14Z")
Finally found what I was looking for. Here are the user api rate limit settings:
---
### Author:  [@fefrei](https://meta.discourse.org/u/fefrei)
#### Post date: [December 3, 2016, 12:58pm UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/17 "2016-12-03T12:58:03Z")
I’m pretty sure that the user API is distinct from the API the admin-generated user API keys work for ☹
---
### Author:  [@nylen](https://meta.discourse.org/u/nylen)
#### Post date: [July 24, 2019, 6:39am UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/18 "2019-07-24T06:39:16Z")
I would like much more fine-grained management of API keys also. I’ve come up with a hacky solution that will allow this to mostly work:
> **[GitHub - nylen/discourse-api-proxy: PHP script to simulate more fine-grained...](https://github.com/nylen/discourse-api-proxy)**
>
> PHP script to simulate more fine-grained authentication capabilities for the Discourse REST API.
---
### Author:  [@chapoi](https://meta.discourse.org/u/chapoi)
#### Post date: [December 4, 2025, 11:32am UTC](https://meta.discourse.org/t/cant-generate-multiple-api-keys/21011/19 "2025-12-04T11:32:28Z")