Generating User Api Keys with REST API

Umer_Mirza · 2017 年5 月 1 日 22:55

Hi
I am trying to generate User api keys. I know I can do it from admin dashboard. But instead of there I want to generate by making REST calls. I am following this post User API keys specification
I am getting error “THIS PAGE IS PRIVATE OR DOES NOT EXISTS” when I try to make a GET request to this https://unityforum.discoursehosting.net/api_key/generate?redirect_url=www.google.com.pk&client_id=2&access_level=read

Can someone please show me how my url should look like with the paramters. I am also confused what exactly is client_id here? Is it the id of the user whose api needs to created or is the username? Also can I use any url as redirect_url? For the record I have added this redirect url in my admin settings.

KunalKamble · 2017 年6 月 23 日 20:20

I am also looking for same solution, can anyone help in this?

j.jaffeux · 2017 年6 月 26 日 09:51

Hello,

to generate an api key for a user:

curl -X "POST" "http://localhost:4000/admin/users/1/generate_api_key?api_key=10efbf2c9a84dfb3b6f60ffa117c029bda7fc9fb8f861ccd0dc8e8fbfa86968d&api_username=joffreyjaffeux"

Learn more about it:

djensen47 · 2017 年11 月 9 日 06:29

@j.jaffeux That’s not the same “API” that @Umer_Mirza was asking about. I put “API” in quote because it may not exist?

The User API keys specification RFC talks about the use case of allowing users themselves the ability to request and API key so that a third party developed app may perform actions on their behalf. You would never want to give a third party your site API key because they would have full access.

I would ask this question in User API keys specification but that topic is closed. Does the API that @sam proposed in that post actually exist or not?

sam · 2017 年11 月 9 日 06:31

Yes user api keys exists and are consumed by the mobile app, look at the source code of the mobile app for exact specifications for now.

I would love to have this better documented so if you want to take that project on

djensen47 · 2017 年11 月 9 日 06:34

Awesome, thanks for the quick response.

Well, maybe I can get something started for documentation. I have to do something on this front anyway so I can post what I come up with here.

j.jaffeux · 2017 年11 月 9 日 16:25

This is the endpoint sam is talking about I think:

github.com/discourse/DiscourseMobile

js/site_manager.js

main


      
                auth_redirect: this.urlScheme,
                user_api_public_key: this.rsaKeys.public,
              };
          
              if (type === 'full') {
                params = {
                  auth_redirect: this.urlScheme,
                  application_name: this.deviceName,
                  public_key: this.rsaKeys.public,
                };
              }
          
              return this.serializeParams(params);
            });
          }
          
          async requestAuth(url) {
            try {
              const authRequest = await SafariWebAuth.requestAuth(
                url,
                this.customScheme,

github.com/discourse/discourse

config/routes.rb

main


      
              }
          get "#{root_path}/:username/messages/group/:group_name" => "users#show",
              :constraints => {
                username: RouteFormat.username,
                group_name: RouteFormat.username,
              }
          get "#{root_path}/:username/messages/group/:group_name/:filter" => "users#show",
              :constraints => {
                username: RouteFormat.username,
                group_name: RouteFormat.username,
              }
          get "#{root_path}/:username/messages/tags/:tag_name" => "list#private_messages_tag",
              :constraints => {
                username: RouteFormat.username,
              }
          get "#{root_path}/:username.json" => "users#show",
              :constraints => {
                username: RouteFormat.username,
              },
              :defaults => {
                format: :json,

github.com/discourse/discourse

app/controllers/user_api_keys_controller.rb

main

# frozen_string_literal: true

class UserApiKeysController < ApplicationController
  layout "no_ember"

  requires_login only: %i[create create_otp revoke undo_revoke]
  skip_before_action :redirect_to_login_if_required,
                     :redirect_to_profile_if_required,
                     only: %i[new otp]
  skip_before_action :check_xhr, :preload_json

  AUTH_API_VERSION = 4
  ALLOWED_PADDING_MODES = %w[pkcs1 oaep].freeze

  def new
    if request.head?
      head :ok, auth_api_version: AUTH_API_VERSION
      return
    end

This file has been truncated. show original

djensen47 · 2017 年11 月 9 日 18:35

Thanks @j.jaffeux. I was drafting a similar message but I only had the code from the mobile app. These other code snippets are very useful.

When I tried this API against my own server using Postman, I kept getting a 400 error with no details. My Ruby is a little rusty but I’ll dig into the code more but if you happen to know why a 400 might happen that would be helpful.

djensen47 · 2017 年11 月 9 日 23:12

I just tried adding my site to the official Discourse app, and it worked so I must be doing something wrong with regard to using the API in Postman.

Aside: I thought the app only worked for officially hosted Discourse sites.

sajattack · 2017 年12 月 28 日 22:18

I’m getting error code 400 when I visit https://community.frontrowcrew.com/user-api-key/new

sajattack · 2018 年1 月 12 日 20:17

Can I get some assistance on this @sam?

codinghorror · 2018 年1 月 13 日 02:58

Did you want to purchase a hosting contract with us?

sajattack · 2018 年1 月 13 日 03:09

No, but if you can point me in the right direction I’d be happy to document it for others.

sajattack · 2018 年4 月 2 日 01:01

By looking at the URL generated by the discourse android app, I’ve uncovered the fields required for
/user-api-key/new

scopes - these are the permissions of the api key, in the case of the official app, to read notifications and to read session info
client-id - hex string, dunno
nonce - another hex string, used as a cryptographic nonce
auth_redirect - url to redirect to after permission is given
application_name - the name to display to the user of the application using the api
public_key - a public RSA key

Still a few questions:

What are all the valid values for scopes?
Where does the client-id come from?
Are all api responses encrypted with the public key or what is it’s purpose?

sajattack · 2018 年4 月 2 日 04:21

So, looking at the source code, client-id is 32 random bytes and nonce is 16 random bytes.
Edit: It’s actually 32 & 16 nybbles, but the code generating it is called randomBytes(32)

sajattack · 2018 年4 月 2 日 22:37

Found the scopes!

github.com/discourse/discourse

app/models/user_api_key.rb

226ace164


      
          class UserApiKey < ActiveRecord::Base
          
            SCOPES = {
              read: [:get],
              write: [:get, :post, :patch],
              message_bus: [[:post, 'message_bus']],
              push: nil,
              notifications: [[:post, 'message_bus'], [:get, 'notifications#index'], [:put, 'notifications#mark_read']],
              session_info: [[:get, 'session#current'], [:get, 'users#topic_tracking_state']]
            }
          
            belongs_to :user

sajattack · 2018 年4 月 2 日 23:23

I’ve written a program that generates URLs of this specification, enough to get me to this screen:

But when I press Authorize I get a 403.

sam · 2018 年4 月 2 日 23:26

After authorize you will be redirected, so the redirect URL needs to go somewhere where you can handle decrypting the payload it redirects with.

Also there is a site setting that lists where the redirect is allowed to go.

sajattack · 2018 年4 月 3 日 07:29

Ok, got my api key. Is this a different API than the admin one documented at http://docs.discourse.org ?

sajattack · 2018 年4 月 8 日 23:41

When I try to make a post with the api documented at http://docs.discourse.org using a user api key, it says

You are not permitted to view the requested resource. The API username or key is invalid.

So I think it’s a different API or needs different fields (client_id?) for authentication.

话题		回复	浏览量
User API keys specification Integrations rest-api , reference	69	38214	2025 年9 月 22 日
Generate User Api Key Without User Approval Development	3	1065	2024 年6 月 2 日
Allow API use by regular users, not just admins Development rest-api	6	1599	2023 年2 月 14 日
Create apikey for user programmatically as admin Development rest-api	8	2179	2024 年2 月 26 日
Can non-admin user issue their own API key? Development rest-api	13	2998	2021 年9 月 2 日

Generating User Api Keys with REST API

AI 生成的摘要

相关话题