Discourse MCP User API Key Generator Error Nodejs >20

[deviantintegral (Andrew Berry)]

Issues aren’t enabled in the GitHub repository, but please let me know if I should post this somewhere else!

When I run the User API Key generator, I get the following error:

Decrypting payload…
[2025-12-01T16:38:59.409Z] ERROR Failed to decrypt payload: RSA_PKCS1_PADDING is no longer supported for private decryption.

It looks like this has been unsupported by default since nodejs 20.

User API keys should use OAEP padding

A minor issue and maybe a bigger one: There’s a required nonce param that’s not mentioned in the documentation: def require_params %i[public_key nonce scopes client_id application_name].each { |p| params.require(p) } end Now the trickier issue. Discourse calls the public_encrypt method with no arguments: That means the padding argument defaults to PKCS1_PADDING. From the Ruby documentation: Encrypt string with the public key. padding defaults to PKCS1_PADDING, which is known to be…

While that post mentions a workaround to re-enable the padding option, that appears to have been disabled since.

$ NODE_OPTIONS='--security-revert=CVE-2023-46809' npx @discourse/mcp@latest generate-user-api-key --site https://example.com --save-to discourse-mcp.json  --scopes "read"
node: --security-revert= is not allowed in NODE_OPTIONS

I’m a little confused, because the code for this was recently added in discourse-mcp/src/user-api-key-generator.ts at 51f144fff8847647d1ba7354d5bc1fe661110a43 · discourse/discourse-mcp · GitHub a few months ago. Perhaps everyone is just using admin generated keys?