# User API keys specification
**URL:** https://meta.discourse.org/t/user-api-keys-specification/48536
**Category:** Integrations
**Tags:** rest-api, reference
**Created:** [August 12, 2016, 2:11am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536 "2016-08-12T02:11:53Z")
**Posts on this page:** 20
**Page:** 3
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [June 16, 2022, 7:19am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/47 "2022-06-16T07:19:58Z")
Open redirects tend to make people nervous, in this case if you add say nextcloud, it means that people will be able to use a url on nextcloud to generate a key on discourse and then redirect back to nextcloud.
---
### Author:  [@aidanohart](https://meta.discourse.org/u/aidanohart)
#### Post date: [July 23, 2022, 1:00am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/48 "2022-07-23T01:00:06Z")
On Step 6, what API call are you specifically referring to?
Or if anyone else knows please answer!
---
### Author:  [@JQ331](https://meta.discourse.org/u/JQ331)
#### Post date: [July 23, 2022, 1:16am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/49 "2022-07-23T01:16:22Z")
The API calls referred to in step six are whatever calls you want to make. That is just referring to the calls that do the thing you actually want to do with the discourse site.
In my case, I had a separate app that would interact with a discourse site - doing things like creating posts on the discourse site based on action a user would take in the separate app. The app would log in the user, the user would do some stuff, and then the app would make POST and PUT api calls to create / edit discourse posts from that user.
---
### Author:  [@aidanohart](https://meta.discourse.org/u/aidanohart)
#### Post date: [July 23, 2022, 10:21am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/50 "2022-07-23T10:21:18Z")
I see. In my case I just want to make it where a user logs in on my website does the Discourse authorization then redirects back and then my website can just read their username,email,avatar,id etc and create a new user on our site. @JQ331
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [July 23, 2022, 10:25am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/51 "2022-07-23T10:25:13Z")
Then you’re in the wrong place, you cannot use the User API keys for this.
Instead, you will need to configure Discourse as the [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) provider and your website as a [DiscourseConnect](https://meta.discourse.org/t/13045?silent=true) client. See [Use Discourse as an identity provider (SSO, DiscourseConnect)](https://meta.discourse.org/t/using-discourse-as-an-identity-provider-sso-discourseconnect/32974)
---
### Author:  [@aidanohart](https://meta.discourse.org/u/aidanohart)
#### Post date: [July 23, 2022, 10:59am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/52 "2022-07-23T10:59:44Z")
I’m right in saying for something like that I am going to need access to the site’s secret key?
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [July 23, 2022, 12:00pm UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/53 "2022-07-23T12:00:55Z")
There is no thing as “the” secret key but you will indeed need admin access to Discourse in order to configure this.
---
### Author:  [@priyambodo.w](https://meta.discourse.org/u/priyambodo.w)
#### Post date: [October 19, 2022, 5:06am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/54 "2022-10-19T05:06:34Z")
Hi, I tried to implement this user api key, but it seems it has API rate limiter. I got 429 after few API calls. Any configuration for this? I use paid hosting.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [October 19, 2022, 8:06am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/55 "2022-10-19T08:06:50Z")
[Here](https://meta.discourse.org/t/available-settings-for-global-rate-limits-and-throttling/78612) is more information about rate limits.
If you are hosting with Communiteq then please contact our support desk via your control panel to get this set up.
---
### Author:  [@priyambodo.w](https://meta.discourse.org/u/priyambodo.w)
#### Post date: [October 19, 2022, 9:21am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/56 "2022-10-19T09:21:41Z")
Hi @RGJ , thanks for the reply. My company has the Standard and Business plan but I cannot see support desk in control panel. Instead I emailed to [team@discourse.org](mailto:team@discourse.org) is that correct?
---
### Author:  [@JammyDodger](https://meta.discourse.org/u/JammyDodger)
#### Post date: [October 19, 2022, 9:35am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/57 "2022-10-19T09:35:44Z")
If you’re hosted with us at Discourse (rather than with @RGJ at Communiteq), that is indeed the correct way to get in contact with our support team. 👍 🙂
---
### Author:  [@gilice](https://meta.discourse.org/u/gilice)
#### Post date: [October 26, 2022, 2:25pm UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/58 "2022-10-26T14:25:00Z")
Hey!
I am writing an application that consumes this api.
Is there some way to get the user’s info (username, mostly) from this?
Or do I need to ask for the username manually, and then request it later?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [October 26, 2022, 3:17pm UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/59 "2022-10-26T15:17:39Z")
Welcome, @gilice.
You don’t mean that you’re consuming the API to get api keys, but that you’re trying to do _something_ with users?
This might help [Reverse engineer the Discourse API](https://meta.discourse.org/t/reverse-engineer-the-discourse-api/20576).
But if you’re trying to get a user’s username, one way to do it is search the email address on the admin/users route.
It would help if you say what you’re trying to do.
---
### Author:  [@gilice](https://meta.discourse.org/u/gilice)
#### Post date: [October 26, 2022, 3:24pm UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/60 "2022-10-26T15:24:19Z")
> [@pfaffman](#):
>
> You don’t mean that you’re consuming the API to get api keys, but that you’re trying to do _something_ with users?
Hey! Thanks for the reply, I should have maybe phrased it better.
The question I wanted to ask: I can get the API key belonging to an user. Then, can I get the user’s profile (username, profile picture, etc) _without asking for their username and using the [getUser method?](https://docs.discourse.org/#tag/Users/operation/getUser)_
---
### Author:  [@mattdm](https://meta.discourse.org/u/mattdm)
#### Post date: [October 26, 2022, 3:28pm UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/61 "2022-10-26T15:28:18Z")
> [@gilice](#):
>
> The question I wanted to ask: I can get the API key belonging to an user.
I’m unclear on how this would work. Where do you want to get the API key _from_? As you can see in the flow, the user needs to log in to get a key in the first place, and they need their normal login information for that. Can you explain more what you’re trying to do?
---
### Author:  [@Viknesh\_Ramm](https://meta.discourse.org/u/Viknesh_Ramm)
#### Post date: [October 27, 2022, 10:00am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/62 "2022-10-27T10:00:40Z")
Hi Everyone,
In my application, I am using user API keys to achieve some of the Discourse functionalities. I have by mistake authorized the login (using the /user-api-key/new API) with the wrong Discourse account.
I have revoked access to the app from the wrong Discourse account. However, when I try to authorize using the correct Discourse account I am getting an error. When I looked into the logs, I found the below error
> ActiveRecord::RecordNotUnique (PG::UniqueViolation: ERROR: duplicate key value violates unique constraint “index\_user\_api\_keys\_on\_client\_id” DETAIL: Key (client\_id)=
Based on the error, I assume we could not associate 2 user accounts for the same client id.
Is there any way to overcome this problem?
Also, is there any API to update the client\_id of a user API key even **when the API key is revoked**?
Thanks!
---
### Author:  [@toc-rox](https://meta.discourse.org/u/toc-rox)
#### Post date: [November 5, 2022, 8:02am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/63 "2022-11-05T08:02:19Z")
> [@sam](#):
>
> ### Global Settings
>
> - **max\_user\_api\_reqs\_per\_minute** : 20
> - **max\_user\_api\_reqs\_per\_day** : 2880
What exactly does that mean?
I’m writing a application that requests data on behalf of a user via user-api-key. The aim is to avoid rate limiting problems. When exactly runs the app into rate limiting problems?
---
### Author:  [@Alexander](https://meta.discourse.org/u/Alexander)
#### Post date: [November 5, 2022, 11:34am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/64 "2022-11-05T11:34:19Z")
> [@gilice](#):
>
> Then, can I get the user’s profile (username, profile picture, etc)
I think you are looking for something like this:
> [@Endpoint for User Information](https://meta.discourse.org/t/endpoint-for-user-information/160145/5):
>
> It’s not officially in the API docs, but I think [https://meta.discourse.org/session/current.json](https://meta.discourse.org/session/current.json) might be useful for this purpose
---
### Author:  [@gilice](https://meta.discourse.org/u/gilice)
#### Post date: [November 7, 2022, 6:25am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/65 "2022-11-07T06:25:13Z")
Yup! That’s what I wanted. Thanks a lot!!!
---
### Author:  [@Kyle-Ye](https://meta.discourse.org/u/Kyle-Ye)
#### Post date: [September 17, 2023, 9:56am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/66 "2023-09-17T09:56:29Z")
Can we get an openapi spec for the User API keys? Or consider adding them to existing spec docs.
> [GitHub - discourse/discourse\_api\_docs: Discourse API Documentation · GitHub](https://github.com/discourse/discourse_api_docs)
For downstream developer, we prefer to use openapi to generate the interface&API we need.
[Previous page](https://meta.discourse.org/t/user-api-keys-specification/48536.md?page=2)
[Next page](https://meta.discourse.org/t/user-api-keys-specification/48536.md?page=4)