# The purpose of the 2 Discourse API systems

**URL:** https://meta.discourse.org/t/the-purpose-of-the-2-discourse-api-systems/155253
**Category:** Support
**Created:** [June 18, 2020, 5:40pm UTC](https://meta.discourse.org/t/the-purpose-of-the-2-discourse-api-systems/155253 "2020-06-18T17:40:09Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 23, 2020, 6:37am UTC](https://meta.discourse.org/t/the-purpose-of-the-2-discourse-api-systems/155253/2 "2020-06-23T06:37:42Z")

</div>

> [@JQ331](#):
>
> But I believe it’s fine to use the Admin API with javascript clients so long as the owner of the app the javascript clients use also controls the forum. (ie, the owner of the separate app is the same as the owner of the forum.) Right?

If you ship an API key in your application it is trivial for a hacker to fish that key out of the application binary or wire protocol.

The user API is immune to this problem, user approves the application and then gets an dedicated API key generated.

---

_[View the full topic](https://meta.discourse.org/t/the-purpose-of-the-2-discourse-api-systems/155253)._