# "Upload: Create" API key insufficient?
**URL:** https://meta.discourse.org/t/upload-create-api-key-insufficient/211896
**Category:** Bug
**Created:** [December 12, 2021, 8:32pm UTC](https://meta.discourse.org/t/upload-create-api-key-insufficient/211896 "2021-12-12T20:32:37Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@mattdm](https://meta.discourse.org/u/mattdm)
#### Post date: [December 12, 2021, 8:32pm UTC](https://meta.discourse.org/t/upload-create-api-key-insufficient/211896/1 "2021-12-12T20:32:37Z")
I’m using the following code to upload through the API:
```plaintext
# And ask Discourse where to send it.
r = requests.post(
f"https://{DISCOURSE}/uploads/generate-presigned-put", json=file_info, headers=HEADERS)
if r.status_code != 200:
print(
f"Error asking where to upload the image: got {r.status_code}", file=sys.stderr)
sys.exit(1)
upload_url = r.json()['url']
upload_uid = r.json()['unique_identifier']
# Now put it where we were told to.
r = requests.put(upload_url, data=image_data)
if r.status_code != 200:
print(
f"Error uploading image to external storage: got {r.status_code}", file=sys.stderr)
sys.exit(1)
# And tell Discourse that it worked, and get back an id we can reference later.
r = requests.post(f"https://{DISCOURSE}/uploads/complete-external-upload",
data=f'unique_identifier={upload_uid}', headers=HEADERS)
if r.status_code != 200:
print(f"Error completing upload: got {r.status_code}", file=sys.stderr)
sys.exit(1)
image_id = r.json()['id']
```
This works with an “all access” API key, but when I try to use a granular one with the “uploads: create” scope, I get a 403 error on `post` to `/uploads/generate-presigned-put`.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [December 13, 2021, 3:52am UTC](https://meta.discourse.org/t/upload-create-api-key-insufficient/211896/2 "2021-12-13T03:52:48Z")
Nice catch, we will get this sorted, keep in mind the protocol is somewhat more complex now that we upload directly to s3.
---
### Author:  [@mattdm](https://meta.discourse.org/u/mattdm)
#### Post date: [December 13, 2021, 9:58am UTC](https://meta.discourse.org/t/upload-create-api-key-insufficient/211896/4 "2021-12-13T09:58:44Z")
I have only started using thr API for this after you switched, so as far as I know this is the normal level of complication. 🙂
Are there situations where the following isn’t sufficient?
1. `POST` file info to `/uploads/generate-presigned-put`
- result includes a remote URL to upload to (which includes authentication parameters) and a unique upload ID
2. `PUT` image data to the URL from above
- handle error if this fails
3. `POST` upload ID from above to `/uploads/complete-external-upload`
- result is an image ID one can use other places in the API (like badge creation)
---
### Author:  [@martin](https://meta.discourse.org/u/martin)
#### Post date: [December 15, 2021, 11:22pm UTC](https://meta.discourse.org/t/upload-create-api-key-insufficient/211896/7 "2021-12-15T23:22:33Z")
Hi @mattdm I’ve updated the API key scope to cover these new actions for our direct upload flow, and I’ve deployed your site too, please let me know if you still have further issues.
---
### Author:  [@mattdm](https://meta.discourse.org/u/mattdm)
#### Post date: [December 15, 2021, 11:47pm UTC](https://meta.discourse.org/t/upload-create-api-key-insufficient/211896/9 "2021-12-15T23:47:03Z")
Confirmed! Works now. Thanks!
---
### Author:  [@david](https://meta.discourse.org/u/david)
#### Post date: [December 17, 2021, 8:00am UTC](https://meta.discourse.org/t/upload-create-api-key-insufficient/211896/11 "2021-12-17T08:00:23Z")
This topic was automatically closed after 20 hours. New replies are no longer allowed.