# Generating User Api Keys with REST API

**URL:** <https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916>\
**Category:** Development\
**Tags:** rest-api\
**Created:** [1. Mai 2017 um 22:55 UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916 "2017-05-01T22:55:27Z")\
**Posts on this page:** 1\
**Showing post:** 15

<div class="post-metadata">

**Author:** ![sajattack](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sajattack/32/85732_2.png) [@sajattack](https://meta.discourse.org/u/sajattack)\
**Post date:** [2. April 2018 um 01:01 UTC](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916/15 "2018-04-02T01:01:25Z")

</div>

By looking at the URL generated by the discourse android app, I’ve uncovered the fields required for  
/user-api-key/new

- scopes - these are the permissions of the api key, in the case of the official app, to read notifications and to read session info
- client-id - hex string, dunno
- nonce - another hex string, used as a cryptographic nonce
- auth\_redirect - url to redirect to after permission is given
- application\_name - the name to display to the user of the application using the api
- public\_key - a public RSA key

Still a few questions:

- What are all the valid values for scopes?
- Where does the client-id come from?
- Are all api responses encrypted with the public key or what is it’s purpose?

---

_[View the full topic](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916)._