# Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers
**URL:** https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662
**Category:** Bug
**Created:** [7월 18, 2018, 5:40오후 UTC](https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662 "2018-07-18T17:40:31Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@davide.porrovecchio](https://meta.discourse.org/u/davide.porrovecchio)
#### Post date: [7월 18, 2018, 5:40오후 UTC](https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662/1 "2018-07-18T17:40:31Z")
I get this error message when trying to use User API key as described in [User API keys specification](https://meta.discourse.org/t/user-api-keys-specification/48536).
I think `User-Api-Key` and `User-Api-Client-Id` should be added to `Access-Control-Allow-Headers` header as defined in [discourse/config/initializers/004-message\_bus.rb at main · discourse/discourse · GitHub](https://github.com/discourse/discourse/blob/master/config/initializers/004-message_bus.rb#L18).
Here is a [PR](https://github.com/discourse/discourse/pull/6107) that fixes this little bug.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [7월 19, 2018, 4:40오전 UTC](https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662/2 "2018-07-19T04:40:45Z")
Hmm @sam would need to peek at this.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [7월 23, 2018, 2:05오전 UTC](https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662/3 "2018-07-23T02:05:40Z")
Hmmm, can you explain how you are consuming the user API, I am not against adding this, just would like some clarification here.
---
### Author:  [@davide.porrovecchio](https://meta.discourse.org/u/davide.porrovecchio)
#### Post date: [7월 23, 2018, 8:06오전 UTC](https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662/4 "2018-07-23T08:06:11Z")
I’m trying to post comments to my Discourse instance from another web application using user api keys. I managed to get the user key following the method described in your [original topic](https://meta.discourse.org/t/user-api-keys-specification/48536) and this [other useful discussion](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916).
After getting the key, when I send it along with my requests as a value of the `User-Api-Key` header, I get the `Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers` error.
As I [asked in my PR](https://github.com/discourse/discourse/pull/6107#issuecomment-406568320), I’m not sure if it’s enough to add the headers in the file `config/initializers/004-message_bus.rb` or we need to add them also in the file `discourse/config/initializers/008-rack-cors.rb`.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [7월 23, 2018, 8:26오전 UTC](https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662/5 "2018-07-23T08:26:11Z")
For comment posting it would be rack cors, message bus would only impact subscribing to the bus.
---
### Author:  [@davide.porrovecchio](https://meta.discourse.org/u/davide.porrovecchio)
#### Post date: [7월 23, 2018, 8:52오전 UTC](https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662/6 "2018-07-23T08:52:24Z")
Ok, thank you for your explanation. I updated my PR accordingly.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [8월 30, 2018, 2:35오전 UTC](https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662/7 "2018-08-30T02:35:32Z")
This is now merged in, thanks!
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [8월 31, 2018, 8:00오전 UTC](https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662/8 "2018-08-31T08:00:00Z")
This topic was automatically closed after 29 hours. New replies are no longer allowed.