The first one fetches the api key for user. Second method that you suggested is good for making automated requests on behalf of user.
But I want to build my own UI with discourse api.
So I want to call login api just like ember client does
I debugged the login flow of ember.
First it calls /csrf?_:18282829 to get a csrf token
Then it calls /session with username and password and csrf token and other headers.
Funny thing is if I intercept the session api call and make it myself(by sending all cookies and headers) I get Bad csrf error.
But the ember client can make the call successfully and get the user details.
So what is your csrf token strategy? Do you match session cookie and header, or is there something like secret in cookie and salt in header?
I tried to find in ruby code, but couldn’t do so. If you can point me to the file, then I will try to figure it out.