# בקשות API מאוחדות באלפים אך האתר שלנו אינו מציג מפתחות API פעילים, האם זה מדאיג?
**URL:** https://meta.discourse.org/t/consolidated-api-requests-in-the-thousands-yet-our-site-has-no-active-api-keys-listed-is-this-a-concern/255547
**Category:** Support
**Created:** [18 בפברואר, 2023, 11:07am UTC](https://meta.discourse.org/t/consolidated-api-requests-in-the-thousands-yet-our-site-has-no-active-api-keys-listed-is-this-a-concern/255547 "2023-02-18T11:07:22Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@EricGT](https://meta.discourse.org/u/EricGT)
#### Post date: [18 בפברואר, 2023, 11:07am UTC](https://meta.discourse.org/t/consolidated-api-requests-in-the-thousands-yet-our-site-has-no-active-api-keys-listed-is-this-a-concern/255547/1 "2023-02-18T11:07:22Z")
This is a curiosity question at present.
On our site ([SWI-Prolog](https://swi-prolog.discourse.group/)) in checking Consolidated API Requests noticed
then checked [https://swi-prolog.discourse.group/admin/api/keys](https://swi-prolog.discourse.group/admin/api/keys)
The way I currently interpret this is that we have no valid and active API keys so there should be no activity reported in Consolidated API Requests.
The only other idea is that a change in the code occurred and now certain replies by users that are not using an API key is counted in the Consolidated API Requests.
If someone can shed some light on/explain this it would be appreciated. :slightly_smiling_face:
Thanks.
---
### Author:  [@ClawdiaWolf](https://meta.discourse.org/u/ClawdiaWolf)
#### Post date: [18 בפברואר, 2023, 7:27pm UTC](https://meta.discourse.org/t/consolidated-api-requests-in-the-thousands-yet-our-site-has-no-active-api-keys-listed-is-this-a-concern/255547/2 "2023-02-18T19:27:42Z")
If I remember correctly that report includes both admin generated API key requests and User API key requests like those from the DiscourseHub app.
edit: yeah, those are User API key requests. It says those are included in the description. Here’s the set from my test instance where I’m the only user and doesn’t have any admin generated keys:
---
### Author:  [@EricGT](https://meta.discourse.org/u/EricGT)
#### Post date: [18 בפברואר, 2023, 7:36pm UTC](https://meta.discourse.org/t/consolidated-api-requests-in-the-thousands-yet-our-site-has-no-active-api-keys-listed-is-this-a-concern/255547/3 "2023-02-18T19:36:20Z")
Thanks but still lost.
Sounds like the title of a new Netflix series.
---
### Author:  [@ClawdiaWolf](https://meta.discourse.org/u/ClawdiaWolf)
#### Post date: [18 בפברואר, 2023, 8:10pm UTC](https://meta.discourse.org/t/consolidated-api-requests-in-the-thousands-yet-our-site-has-no-active-api-keys-listed-is-this-a-concern/255547/4 "2023-02-18T20:10:44Z")
Basically, those requests you’re seeing in the report are most likely from users using the DiscourseHub mobile application. Those keys won’t show up in the admin panel. :slight_smile:
This topic explains what User API keys are. The official DiscourseHub app is just one implementation of it.
> [@User API keys specification](https://meta.discourse.org/t/user-api-keys-specification/48536):
>
> Discourse contains a system for generating API keys per user if a very specific protocol is followed. This feature facilitates “application” access to Discourse instances without needing to involve moderators. High level description At a high level: Client (desktop app, browser plugin, mobile app) generates a private/public key pair and return url Client redirects to a route on discourse giving discourse its public key Discourse gets approval from user to use app Discourse generat…
---
### Author:  [@EricGT](https://meta.discourse.org/u/EricGT)
#### Post date: [19 בפברואר, 2023, 7:46am UTC](https://meta.discourse.org/t/consolidated-api-requests-in-the-thousands-yet-our-site-has-no-active-api-keys-listed-is-this-a-concern/255547/5 "2023-02-19T07:46:37Z")
Thanks for responding.
> [@ClawdiaWolf](#):
>
> most likely from users using the DiscourseHub mobile application
That statement had me look into what is the DiscourseHub mobile application. As near as I can figure it is
>
>
> Discourse notifier and browse...
My take on what you are saying is that
Users of the DiscourseHub mobile app are getting a user API key. The users do not know they are requesting a user API key because the app does it seamlessly. Also the request for user API will not show up in the report of listed keys.
It’s possible that your idea is correct, but I would feel more confident if I could review the code that implements it. Please excuse my cautious approach, as it’s common in my profession as a programmer to request direct access to the code in order to verify information. Since Discourse is an open source platform, examining the code would provide stronger evidence and help me better understand the situation. :slightly_smiling_face: (ChatGPT rephrased that paragraph for me, my version sounded slightly harsh and that was not the intent.)
---
### Author:  [@ClawdiaWolf](https://meta.discourse.org/u/ClawdiaWolf)
#### Post date: [19 בפברואר, 2023, 1:06pm UTC](https://meta.discourse.org/t/consolidated-api-requests-in-the-thousands-yet-our-site-has-no-active-api-keys-listed-is-this-a-concern/255547/6 "2023-02-19T13:06:38Z")
I’m a programmer as well, but I don’t touch the core Dsicourse code so I don’t know the exact files you need to look at on GitHub, but I’m sure someone else can direct to the right places.
The source code for the DiscourseHub application is also open source. That repo is here:
[https://GitHub.com/discourse/DiscourseMobile](https://GitHub.com/discourse/DiscourseMobile)