# Seems that moderators can get admin's API keys?

**URL:** https://meta.discourse.org/t/seems-that-moderators-can-get-admins-api-keys/34053
**Category:** Bug
**Created:** [October 2, 2015, 4:30pm UTC](https://meta.discourse.org/t/seems-that-moderators-can-get-admins-api-keys/34053 "2015-10-02T16:30:35Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![Toxaris](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/toxaris/32/116578_2.png) [@Toxaris](https://meta.discourse.org/u/Toxaris)
#### Post date: [October 2, 2015, 4:30pm UTC](https://meta.discourse.org/t/seems-that-moderators-can-get-admins-api-keys/34053/1 "2015-10-02T16:30:35Z")

</div>

I’m an admin on a discourse instance and created an API key. When I impersonated a moderator and then went to the admin page about my actual admin user, I could see the API key there. I expect that to be a security issue.

How much do I need to trust my moderators?

---

<div class="post-metadata">

### Author: ![michaeld](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/michaeld/32/1594_2.png) [@michaeld](https://meta.discourse.org/u/michaeld)
#### Post date: [October 2, 2015, 6:09pm UTC](https://meta.discourse.org/t/seems-that-moderators-can-get-admins-api-keys/34053/2 "2015-10-02T18:09:37Z")

</div>

I can confirm this issue. Seems to me that a moderator shouldn’t be able to access _any_ API key.

I first suspected this to be an impersonation artefact, but when I create a moderator and log in to that account directly, I can see API keys for all users including admin as well.

---

<div class="post-metadata">

### Author: ![cpradio](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/cpradio/32/4970_2.png) [@cpradio](https://meta.discourse.org/u/cpradio)
#### Post date: [October 2, 2015, 6:10pm UTC](https://meta.discourse.org/t/seems-that-moderators-can-get-admins-api-keys/34053/3 "2015-10-02T18:10:16Z")

</div>

> [@michaeld](#):
>
> Seems to me that a moderator shouldn’t be able to access any API key.

Unless it is assigned to their own username. 😉 (that is my only caveat)

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 2, 2015, 6:48pm UTC](https://meta.discourse.org/t/seems-that-moderators-can-get-admins-api-keys/34053/4 "2015-10-02T18:48:16Z")

</div>

Probably an oversight, we should patch this up for moderators vs admins @eviltrout.

---

<div class="post-metadata">

### Author: ![eviltrout](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/eviltrout/32/5275_2.png) [@eviltrout](https://meta.discourse.org/u/eviltrout)
#### Post date: [October 14, 2015, 7:47pm UTC](https://meta.discourse.org/t/seems-that-moderators-can-get-admins-api-keys/34053/5 "2015-10-14T19:47:33Z")

</div>

I’ve made it so moderators can’t see the API keys:

[https://github.com/discourse/discourse/commit/e8424bd54e4c7d1bff5f8c3f87f931648ee94020](https://github.com/discourse/discourse/commit/e8424bd54e4c7d1bff5f8c3f87f931648ee94020)

Also backported fix to stable + beta branches.

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [October 14, 2015, 10:28pm UTC](https://meta.discourse.org/t/seems-that-moderators-can-get-admins-api-keys/34053/6 "2015-10-14T22:28:26Z")

</div>