---
### Author:  [@djensen47](https://meta.discourse.org/u/djensen47)
#### Post date: [November 9, 2017, 6:35pm UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/9 "2017-11-09T18:35:48Z")
Thanks @j.jaffeux. I was drafting a similar message but I only had the code from the mobile app. These other code snippets are very useful.
When I tried this API against my own server using Postman, I kept getting a 400 error with no details. My Ruby is a little rusty but I’ll dig into the code more _but_ if you happen to know why a 400 might happen that would be helpful.
---
### Author:  [@djensen47](https://meta.discourse.org/u/djensen47)
#### Post date: [November 9, 2017, 11:12pm UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/10 "2017-11-09T23:12:20Z")
I just tried adding my site to the official Discourse app, and it worked so I must be doing something wrong with regard to using the API in Postman.
_Aside_: I thought the app only worked for officially hosted Discourse sites. 🤷♂️
---
### Author:  [@sajattack](https://meta.discourse.org/u/sajattack)
#### Post date: [December 28, 2017, 10:18pm UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/11 "2017-12-28T22:18:37Z")
I’m getting error code 400 when I visit [https://community.frontrowcrew.com/user-api-key/new](https://community.frontrowcrew.com/user-api-key/new)
---
### Author:  [@sajattack](https://meta.discourse.org/u/sajattack)
#### Post date: [January 12, 2018, 8:17pm UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/12 "2018-01-12T20:17:48Z")
Can I get some assistance on this @sam?
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [January 13, 2018, 2:58am UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/13 "2018-01-13T02:58:52Z")
Did you want to purchase a hosting contract with us?
---
### Author:  [@sajattack](https://meta.discourse.org/u/sajattack)
#### Post date: [January 13, 2018, 3:09am UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/14 "2018-01-13T03:09:47Z")
No, but if you can point me in the right direction I’d be happy to document it for others.
---
### Author:  [@sajattack](https://meta.discourse.org/u/sajattack)
#### Post date: [April 2, 2018, 1:01am UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/15 "2018-04-02T01:01:25Z")
By looking at the URL generated by the discourse android app, I’ve uncovered the fields required for
/user-api-key/new
- scopes - these are the permissions of the api key, in the case of the official app, to read notifications and to read session info
- client-id - hex string, dunno
- nonce - another hex string, used as a cryptographic nonce
- auth\_redirect - url to redirect to after permission is given
- application\_name - the name to display to the user of the application using the api
- public\_key - a public RSA key
Still a few questions:
- What are all the valid values for scopes?
- Where does the client-id come from?
- Are all api responses encrypted with the public key or what is it’s purpose?
---
### Author:  [@sajattack](https://meta.discourse.org/u/sajattack)
#### Post date: [April 2, 2018, 4:21am UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/16 "2018-04-02T04:21:33Z")
So, looking at the source code, client-id is 32 random bytes and nonce is 16 random bytes.
Edit: It’s actually 32 & 16 nybbles, but the code generating it is called randomBytes(32)
---
### Author:  [@sajattack](https://meta.discourse.org/u/sajattack)
#### Post date: [April 2, 2018, 10:37pm UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/17 "2018-04-02T22:37:13Z")
Found the scopes!
>
---
### Author:  [@sajattack](https://meta.discourse.org/u/sajattack)
#### Post date: [April 2, 2018, 11:23pm UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/18 "2018-04-02T23:23:18Z")
I’ve written a program that generates URLs of this specification, enough to get me to this screen:
But when I press Authorize I get a 403.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [April 2, 2018, 11:26pm UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/19 "2018-04-02T23:26:37Z")
After authorize you will be redirected, so the redirect URL needs to go somewhere where you can handle decrypting the payload it redirects with.
Also there is a site setting that lists where the redirect is allowed to go.
---
### Author:  [@sajattack](https://meta.discourse.org/u/sajattack)
#### Post date: [April 3, 2018, 7:29am UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/20 "2018-04-03T07:29:53Z")
Ok, got my api key. Is this a different API than the admin one documented at [http://docs.discourse.org](http://docs.discourse.org) ?
---
### Author:  [@sajattack](https://meta.discourse.org/u/sajattack)
#### Post date: [April 8, 2018, 11:41pm UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/21 "2018-04-08T23:41:16Z")
When I try to make a post with the api documented at [http://docs.discourse.org](http://docs.discourse.org) using a user api key, it says
> You are not permitted to view the requested resource. The API username or key is invalid.
So I think it’s a different API or needs different fields (client\_id?) for authentication.
[Next page](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916.md?page=2)