# Session/current always returns api\_user
**URL:** https://meta.discourse.org/t/session-current-always-returns-api-user/72875
**Category:** Development
**Created:** [October 26, 2017, 8:33pm UTC](https://meta.discourse.org/t/session-current-always-returns-api-user/72875 "2017-10-26T20:33:09Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@rodeezy](https://meta.discourse.org/u/rodeezy)
#### Post date: [October 26, 2017, 8:33pm UTC](https://meta.discourse.org/t/session-current-always-returns-api-user/72875/1 "2017-10-26T20:33:09Z")
/session/current.json gives the current user just fine when entered as url.
/session/current.json?api\_key=[my\_api\_key]&api\_user=[my\_user\_name] always returns me as the current user-- even when I’m logged in as a different account.
I need the api\_user and api\_key to fetch this info though.
Any solution to this?
Thanks!
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [October 26, 2017, 9:42pm UTC](https://meta.discourse.org/t/session-current-always-returns-api-user/72875/2 "2017-10-26T21:42:45Z")
When you’re logged in, you don’t need an API key.
You’ll need an API key for the cases where you’re not logged in (because you are not a human with a login session). When you supply an api\_user parameter, it always determines the user that is making the request.
---
### Author:  [@rodeezy](https://meta.discourse.org/u/rodeezy)
#### Post date: [October 26, 2017, 9:58pm UTC](https://meta.discourse.org/t/session-current-always-returns-api-user/72875/3 "2017-10-26T21:58:18Z")
When I make a fetch request from a different site without an api key, it gives me a 404.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [October 27, 2017, 6:01am UTC](https://meta.discourse.org/t/session-current-always-returns-api-user/72875/4 "2017-10-27T06:01:20Z")
I’m not sure what you are trying to accomplish here, but it sounds like your making a client side JSON request from another web site to see if you’re logged in. That will expose your API key and it’s not a good idea.
The reason that this is not working without an API key is probably because your browser is not sending cookies to a third party website. I believe that Safari is acting like this.
Can you please elaborate on what you are trying to do?