# User API keys specification

**URL:** <https://meta.discourse.org/t/user-api-keys-specification/48536>\
**Category:** Integrations\
**Tags:** rest-api, reference\
**Created:** [August 12, 2016, 2:11am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536 "2016-08-12T02:11:53Z")\
**Posts on this page:** 1\
**Showing post:** 36

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [March 20, 2020, 1:47am UTC](https://meta.discourse.org/t/user-api-keys-specification/48536/36 "2020-03-20T01:47:25Z")

</div>

I like that the API key would be flagged explicitly as “allowed in GET” at the user level.

As a whole the option could be open for any GETs. The rule I like is, when operating in this mode:

1. User API key is 100% restricted to a single specific GET controller action
2. User API key is flagged as allowed in GET query params.

This limits the impact of any leak here via a proxy cause the key will never be reused.

> [@david](#):
>
> (Aside: why are we using nested arrays here…)

I guess `{get: 'list#new'} , {get: 'list#latest'}` would work as well.

---

_[View the full topic](https://meta.discourse.org/t/user-api-keys-specification/48536)._