# Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers

**URL:** https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662
**Category:** Bug
**Created:** [18 juli 2018 om 17:40 UTC](https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662 "2018-07-18T17:40:31Z")
**Posts on this page:** 1
**Showing post:** 4

<div class="post-metadata">

### Author: ![davide.porrovecchio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/davide.porrovecchio/32/119681_2.png) [@davide.porrovecchio](https://meta.discourse.org/u/davide.porrovecchio)
#### Post date: [23 juli 2018 om 08:06 UTC](https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662/4 "2018-07-23T08:06:11Z")

</div>

I’m trying to post comments to my Discourse instance from another web application using user api keys. I managed to get the user key following the method described in your [original topic](https://meta.discourse.org/t/user-api-keys-specification/48536) and this [other useful discussion](https://meta.discourse.org/t/generating-user-api-keys-with-rest-api/61916).  
After getting the key, when I send it along with my requests as a value of the `User-Api-Key` header, I get the `Request header field User-Api-Key is not allowed by Access-Control-Allow-Headers` error.  
As I [asked in my PR](https://github.com/discourse/discourse/pull/6107#issuecomment-406568320), I’m not sure if it’s enough to add the headers in the file `config/initializers/004-message_bus.rb` or we need to add them also in the file `discourse/config/initializers/008-rack-cors.rb`.

---

_[View the full topic](https://meta.discourse.org/t/request-header-field-user-api-key-is-not-allowed-by-access-control-allow-headers/92662)._