# Invalid Access using Global Key on All users
**URL:** https://meta.discourse.org/t/invalid-access-using-global-key-on-all-users/171645
**Category:** Development
**Tags:** rest-api
**Created:** [November 29, 2020, 4:57pm UTC](https://meta.discourse.org/t/invalid-access-using-global-key-on-all-users/171645 "2020-11-29T16:57:08Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@JustinBack](https://meta.discourse.org/u/JustinBack)
#### Post date: [November 29, 2020, 4:57pm UTC](https://meta.discourse.org/t/invalid-access-using-global-key-on-all-users/171645/1 "2020-11-29T16:57:08Z")
Just noticed this issue today.
Generating an api key for **all users** with global scopes, then updating a topic will result in an `invalid_access`
```bash
curl --location --request PUT 'https://example.com/t/-/365.json' \
--header 'Api-User: system' \
--header 'Api-Key: ***' \
--header 'Content-Type: application/json' \
--data-raw '{
"tags": ["awesome-tag"]
}'
```
```json
{
"errors": [
"You are not permitted to view the requested resource. The API username or key is invalid."
],
"error_type": "invalid_access"
}
```
However if you generate a global api key for the user `system`, it works: Same request , different key.
```bash
curl --location --request PUT 'https://example.com/t/-/365.json' \
--header 'Api-User: system' \
--header 'Api-Key: DIFFERENT_KEY' \
--header 'Content-Type: application/json' \
--data-raw '{
"tags": ["awesome-tag"]
}'
```
```json
{
"basic_topic": {
"id": 365,
"title": "Test topic",
"fancy_title": "Test topic",
"slug": "test-topic",
"posts_count": 6
}
}
```
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [November 29, 2020, 6:38pm UTC](https://meta.discourse.org/t/invalid-access-using-global-key-on-all-users/171645/2 "2020-11-29T18:38:53Z")
> [@JustinBack](#):
>
> `--header 'Api-User: system'`
This should be `Api-Username`, not `Api-User`
This header is only used for “all user” api keys, so that’s why it worked when you scoped the key to a specific user.
---
### Author:  [@JustinBack](https://meta.discourse.org/u/JustinBack)
#### Post date: [November 29, 2020, 6:52pm UTC](https://meta.discourse.org/t/invalid-access-using-global-key-on-all-users/171645/3 "2020-11-29T18:52:57Z")
Ah alright, was that changed recently? As I had in mind that the header is `Api-User`
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [December 29, 2020, 6:53pm UTC](https://meta.discourse.org/t/invalid-access-using-global-key-on-all-users/171645/4 "2020-12-29T18:53:04Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.