I’m hoping to clarify when and for what purposes the two Discourse API Authentication systems operate. [图片] API CORS Headers Incorrect We have two different API authentication systems, which can be confusing. (from here ). This is my best understanding: The Admin API , sometimes also referre…

[图片] JQ331: But I believe it’s fine to use the Admin API with javascript clients so long as the owner of the app the javascript clients use also controls the forum. (ie, the owner of the separate app is the same as the owner of the forum.) Right? If you ship an API key in your application it …

[图片] sam: The user API is immune to this problem, user approves the application and then gets an dedicated API key generated. What is the key use case for the Admin API? In my case, I am using it to: Add things to my forum, by making API calls that send data I show on my forum. An alternat…

[图片] JQ331: Allow a separate app I have to interact with my forum. [图片] JQ331: In both cases, the user API would not work, User api was designed for this, see the source code of Discourse Hub for a reference implementation.

What is the admin api designed for?

Admin API is for server-to-server interactions, e.g. calls made from the backend of a website.

双 Discourse API 系统的用途

支持

sam (Sam Saffron) 2020 年6 月 23 日 06:37 2

如果您将 API 密钥打包在应用程序中，黑客很容易从应用程序二进制文件或网络协议中提取该密钥。

用户 API 则不受此问题影响：用户授权应用程序后，系统会为其生成专用的 API 密钥。

Using JavaScript fetch to get publicly available page from Discourse into an external site (Discourse API)

话题		回复	浏览量
Allow API use by regular users, not just admins Development rest-api	7	1326	2023 年4 月 29 日
User API keys specification Integrations rest-api , reference	70	35372	2025 年9 月 22 日
Create apikey for user programmatically as admin Development rest-api	8	1950	2024 年2 月 26 日
Can non-admin user issue their own API key? Development rest-api	13	2667	2021 年9 月 2 日
Online User API? Development	2	1911	2016 年3 月 20 日

双 Discourse API 系统的用途

相关话题