# How can I obtain cookies for a user or a 'user-api-key' without requiring user interaction or browser redirects?

**URL:** https://meta.discourse.org/t/how-can-i-obtain-cookies-for-a-user-or-a-user-api-key-without-requiring-user-interaction-or-browser-redirects/389618
**Category:** Development
**Tags:** rest-api, user-api
**Created:** [November 25, 2025, 4:56pm UTC](https://meta.discourse.org/t/how-can-i-obtain-cookies-for-a-user-or-a-user-api-key-without-requiring-user-interaction-or-browser-redirects/389618 "2025-11-25T16:56:53Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Alexandre\_Gurgel1](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/alexandre_gurgel1/32/531032_2.png) [@Alexandre\_Gurgel1](https://meta.discourse.org/u/Alexandre_Gurgel1)
#### Post date: [November 25, 2025, 4:56pm UTC](https://meta.discourse.org/t/how-can-i-obtain-cookies-for-a-user-or-a-user-api-key-without-requiring-user-interaction-or-browser-redirects/389618/1 "2025-11-25T16:56:53Z")

</div>

I’m currently developing an application that uses Discourse only as an API. The new feature relates to PMs, where we’re using private\_messages. The issue here is that we need to receive updates from these private topics (private\_messages) through the MessageBus, and currently our authentication method with Username: user.username and Api-Key: admin\_api\_key doesn’t work exclusively for this case of MessageBus and private topics; it works for everything else.

So we need a way to obtain and inject cookies into our frontend when calling the MessageBus, or to create a ‘user-api-key’ and user instead of the api-key. But we need to do this only via API, since our backend will communicate with the Discourse backend and provision everything. The frontend will only be responsible for receiving the cookie or user-api-key and adding it to the MessageBus request.

---

<div class="post-metadata">

### Author: ![NateDhaliwal](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/natedhaliwal/32/313494_2.png) [@NateDhaliwal](https://meta.discourse.org/u/NateDhaliwal)
#### Post date: [November 25, 2025, 10:44pm UTC](https://meta.discourse.org/t/how-can-i-obtain-cookies-for-a-user-or-a-user-api-key-without-requiring-user-interaction-or-browser-redirects/389618/2 "2025-11-25T22:44:51Z")

</div>

> [@Alexandre\_Gurgel1](#):
>
> DMs

I assume tbis is a typo and you’re referring to PMs? DMs are related to #chat.

---

<div class="post-metadata">

### Author: ![blake](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/blake/32/157322_2.png) [@blake](https://meta.discourse.org/u/blake)
#### Post date: [November 25, 2025, 11:04pm UTC](https://meta.discourse.org/t/how-can-i-obtain-cookies-for-a-user-or-a-user-api-key-without-requiring-user-interaction-or-browser-redirects/389618/3 "2025-11-25T23:04:02Z")

</div>

> [@Alexandre\_Gurgel1](#):
>
> I’m currently developing an application that uses Discourse only as an API.

Oh cool!

> [@Alexandre\_Gurgel1](#):
>
> But we need to do this only via API

There’s no HTTP API endpoint for creating UserApiKey objects for other users. The /user-api-key endpoint only creates keys for the logged-in user

Using MessageBus would be handy, but I’m not sure how to get around the authentication issues. You might need to do polling and/or rely on webhooks for when PMs are updated.

---

<div class="post-metadata">

### Author: ![Alexandre\_Gurgel1](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/alexandre_gurgel1/32/531032_2.png) [@Alexandre\_Gurgel1](https://meta.discourse.org/u/Alexandre_Gurgel1)
#### Post date: [November 26, 2025, 4:00pm UTC](https://meta.discourse.org/t/how-can-i-obtain-cookies-for-a-user-or-a-user-api-key-without-requiring-user-interaction-or-browser-redirects/389618/4 "2025-11-26T16:00:05Z")

</div>

Yeah! The topics with `archtype: private_message`