Consolidated API Requests in the thousands yet our site has no active API keys listed, is this a concern?

[ClawdiaWolf (Claudia)]

Basically, those requests you’re seeing in the report are most likely from users using the DiscourseHub mobile application. Those keys won’t show up in the admin panel.

This topic explains what User API keys are. The official DiscourseHub app is just one implementation of it.

User API keys specification

Discourse contains a system for generating API keys per user if a very specific protocol is followed. This feature facilitates “application” access to Discourse instances without needing to involve moderators. High level description At a high level: Client (desktop app, browser plugin, mobile app) generates a private/public key pair and return url Client redirects to a route on discourse giving discourse its public key Discourse gets approval from user to use app Discourse genera…