# Especificação das chaves de API do usuário **URL:** \ **Category:** Integrations\ **Tags:** rest-api, reference\ **Created:** [12 Agosto , 2016 02:11 UTC](https://meta.discourse.org/t/user-api-keys-specification/48536 "2016-08-12T02:11:53Z")\ **Posts on this page:** 1\ **Showing post:** 19
**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\ **Post date:** [6 Dezembro , 2018 23:05 UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/19 "2018-12-06T23:05:19Z")
> [@vsoch](#): > > Is this what you are talking about? Yes. > [@vsoch](#): > > it would be logical to provide this function (to users with a certain trust level, for example) from within the site. Otherwise, it would need to be the case that the site generates some external page (with a server to hide an admin token) to generate the keys for the user. Is it the case that 1. there is no internal generation of tokens for the user (and why not?) and 2. Nobody has created some external app (javascript, flask, anything really) to perform this action? Possibly, conceptually 1. This is tricky to consume cause you need to use custom HTTP headers (by design) 2. It would be very hard to educate even TL3 users about what the point is of this thing. I prefer not to ship UI for this in core, but maybe you should write a plugin for your specific use case? Can you explain a bit more about the “why” here? The design of the system centers around “I have an external dedicated program”, “this program knows how to follow Discourse protocol”, “It asks for token” API keys (non user ones) are much easier to consume cause you just append them after the `?` --- _[View the full topic](https://meta.discourse.org/t/user-api-keys-specification/48536)._