# Discourse MCP User API Key Generator Error Nodejs \>20

**URL:** https://meta.discourse.org/t/discourse-mcp-user-api-key-generator-error-nodejs-20/390073
**Category:** Support
**Tags:** mcp
**Created:** [December 1, 2025, 4:56pm UTC](https://meta.discourse.org/t/discourse-mcp-user-api-key-generator-error-nodejs-20/390073 "2025-12-01T16:56:38Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![deviantintegral](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/deviantintegral/32/263008_2.png) [@deviantintegral](https://meta.discourse.org/u/deviantintegral)
#### Post date: [December 1, 2025, 4:56pm UTC](https://meta.discourse.org/t/discourse-mcp-user-api-key-generator-error-nodejs-20/390073/1 "2025-12-01T16:56:38Z")

</div>

Issues aren’t enabled in the GitHub repository, but please let me know if I should post this somewhere else!

When I run the User API Key generator, I get the following error:

```plaintext
Decrypting payload…
[2025-12-01T16:38:59.409Z] ERROR Failed to decrypt payload: RSA_PKCS1_PADDING is no longer supported for private decryption.

```

It looks like this has been unsupported by default since nodejs 20.

> [@User API keys should use OAEP padding](https://meta.discourse.org/t/user-api-keys-should-use-oaep-padding/354056):
>
> A minor issue and maybe a bigger one: There’s a required nonce param that’s not mentioned in the documentation: def require\_params %i[public\_key nonce scopes client\_id application\_name].each { |p| params.require(p) } end Now the trickier issue. Discourse calls the public\_encrypt method with no arguments: That means the padding argument defaults to PKCS1\_PADDING. From the [Ruby documentation](https://docs.ruby-lang.org/en/3.2/OpenSSL/PKey/RSA.html): Encrypt string with the public key. padding defaults to [PKCS1\_PADDING](https://docs.ruby-lang.org/en/3.2/OpenSSL/PKey/RSA.html#PKCS1_PADDING), which is known to be…

While that post mentions a workaround to re-enable the padding option, that appears to have been disabled since.

```plaintext
$ NODE_OPTIONS='--security-revert=CVE-2023-46809' npx @discourse/mcp@latest generate-user-api-key --site https://example.com --save-to discourse-mcp.json --scopes "read"
node: --security-revert= is not allowed in NODE_OPTIONS

```

I’m a little confused, because the code for this was recently added in [discourse-mcp/src/user-api-key-generator.ts at 51f144fff8847647d1ba7354d5bc1fe661110a43 · discourse/discourse-mcp · GitHub](https://github.com/discourse/discourse-mcp/blob/51f144fff8847647d1ba7354d5bc1fe661110a43/src/user-api-key-generator.ts) a few months ago. Perhaps everyone is just using admin generated keys?

---

_[View the full topic](https://meta.discourse.org/t/discourse-mcp-user-api-key-generator-error-nodejs-20/390073)._