# Invalid Access using Global Key on All users

**URL:** <https://meta.discourse.org/t/invalid-access-using-global-key-on-all-users/171645>\
**Category:** Development\
**Tags:** rest-api\
**Created:** [November 29, 2020, 4:57pm UTC](https://meta.discourse.org/t/invalid-access-using-global-key-on-all-users/171645 "2020-11-29T16:57:08Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![JustinBack](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/justinback/32/133266_2.png) [@JustinBack](https://meta.discourse.org/u/JustinBack)\
**Post date:** [November 29, 2020, 4:57pm UTC](https://meta.discourse.org/t/invalid-access-using-global-key-on-all-users/171645/1 "2020-11-29T16:57:08Z")

</div>

Just noticed this issue today.

Generating an api key for **all users** with global scopes, then updating a topic will result in an `invalid_access`

```bash
curl --location --request PUT 'https://example.com/t/-/365.json' \
--header 'Api-User: system' \
--header 'Api-Key: ***' \
--header 'Content-Type: application/json' \
--data-raw '{
    "tags": ["awesome-tag"]
}'

```

```json
{
    "errors": [
        "You are not permitted to view the requested resource. The API username or key is invalid."
    ],
    "error_type": "invalid_access"
}

```

However if you generate a global api key for the user `system`, it works: Same request , different key.

```bash
curl --location --request PUT 'https://example.com/t/-/365.json' \
--header 'Api-User: system' \
--header 'Api-Key: DIFFERENT_KEY' \
--header 'Content-Type: application/json' \
--data-raw '{
    "tags": ["awesome-tag"]
}'

```

```json
{
    "basic_topic": {
        "id": 365,
        "title": "Test topic",
        "fancy_title": "Test topic",
        "slug": "test-topic",
        "posts_count": 6
    }
}

```

---

_[View the full topic](https://meta.discourse.org/t/invalid-access-using-global-key-on-all-users/171645)._