# What scopes exactly does the Wordpress API key need?
**URL:** https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812
**Category:** WordPress
**Created:** [January 11, 2021, 8:57pm UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812 "2021-01-11T20:57:39Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@mattdm](https://meta.discourse.org/u/mattdm)
#### Post date: [January 11, 2021, 8:57pm UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/1 "2021-01-11T20:57:39Z")
I would prefer to not give a global API key to the wordpress plugin. I don’t want a compromise in the wordpress site to result in user accounts deleted (or edited, or logged out). However, limiting the scopes by guesswork seems to give weird results (like it can’t load subcategories).
What scopes does this actually need to work?
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [January 11, 2021, 10:24pm UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/2 "2021-01-11T22:24:55Z")
With the Wordpress pre-dating the Admin API scopes by several years I doubt it can work with it.
It’s an interesting feature request.
---
### Author:  [@mattdm](https://meta.discourse.org/u/mattdm)
#### Post date: [January 11, 2021, 10:37pm UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/3 "2021-01-11T22:37:24Z")
I would really appreciate it. The global API key can do a lot of things, and we’re using our Discourse instance for more than just the blog comments, so it’d be nice to keep it scoped to just what it needs.
---
### Author:  [@mattdm](https://meta.discourse.org/u/mattdm)
#### Post date: [January 11, 2021, 11:29pm UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/4 "2021-01-11T23:29:27Z")
> [@Falco](#):
>
> It’s an interesting feature request.
Is such a feature request better in this category, or in features?
---
### Author:  [@angus](https://meta.discourse.org/u/angus)
#### Post date: [January 12, 2021, 7:36am UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/5 "2021-01-12T07:36:31Z")
I’ve been thinking the same thing! (I currently maintain the plugin). This is the right category to raise it.
I’ll discuss it with @simon and get back to you.
---
### Author:  [@mattdm](https://meta.discourse.org/u/mattdm)
#### Post date: [December 11, 2021, 5:47pm UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/6 "2021-12-11T17:47:54Z")
@angus Did this go anywhere? We’d like to use this on one of our wordpress sites where we have a less-than-tightly-controlled set of users with admin access, and I don’t want that to be an escalation into full admin access on our Discourse site.
---
### Author:  [@angus](https://meta.discourse.org/u/angus)
#### Post date: [December 14, 2021, 5:55am UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/7 "2021-12-14T05:55:18Z")
Hey Matt, thanks for the bump on this. I’ll give you a full response by the end of the week.
---
### Author:  [@angus](https://meta.discourse.org/u/angus)
#### Post date: [December 20, 2021, 2:15am UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/8 "2021-12-20T02:15:17Z")
@mattdm An update on this. I’m preparing changes that will allow you to generate an API key with scopes specific to the feature-set of the [WP Discourse](https://github.com/discourse/wp-discourse) plugin you’re using.
This will require changes to core Discourse, so it is subject to approval. Will keep you up to date this week as I make a PR.
---
### Author:  [@angus](https://meta.discourse.org/u/angus)
#### Post date: [December 20, 2021, 9:50am UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/9 "2021-12-20T09:50:31Z")
@mattdm Update: there are two PRs in draft that seek to address this. As mentioned the approach will needs to be approved first. More explanatory notes on the `discourse/discourse` PR.
[https://github.com/discourse/discourse/pull/15366](https://github.com/discourse/discourse/pull/15366)
[https://github.com/discourse/wp-discourse/pull/431](https://github.com/discourse/wp-discourse/pull/431)
---
### Author:  [@mattdm](https://meta.discourse.org/u/mattdm)
#### Post date: [April 8, 2022, 6:35pm UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/10 "2022-04-08T18:35:51Z")
This looks like it has stalled out. I’d like to use this plugin for Fedora Magazine, which has a pretty open access policy by design — even more than the Fedora Community Blog which we’re using it with currently. Any news, by any chance?
---
### Author:  [@angus](https://meta.discourse.org/u/angus)
#### Post date: [April 9, 2022, 10:03am UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/11 "2022-04-09T10:03:13Z")
Thanks for the prompt @mattdm, and good timing as I have it in my calendar to pick this up again next week now there’s been some movement on the Discourse PR. Will give you an update on this next week.
---
### Author:  [@angus](https://meta.discourse.org/u/angus)
#### Post date: [April 18, 2022, 1:07pm UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/12 "2022-04-18T13:07:24Z")
Just a note that the Discourse piece of this has been submitted for review (i.e. moved out of draft).
[https://github.com/discourse/discourse/pull/15366](https://github.com/discourse/discourse/pull/15366)
Once that’s merged, the [WP Discourse](https://github.com/discourse/wp-discourse) piece can be merged and released.
---
### Author:  [@angus](https://meta.discourse.org/u/angus)
#### Post date: [May 24, 2022, 4:34pm UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/13 "2022-05-24T16:34:19Z")
@mattdm Granular scopes are now released in [WP Discourse](https://github.com/discourse/wp-discourse) `2.4.3` 🎉. If you’re on the latest Discourse and the latest version of the plugin you’ll be able to use them. I’ll be publishing a full guide on how to use them later in the week.
_edit_ Here’s the guide!
> [@Connect WP Discourse to Discourse](https://meta.discourse.org/t/connect-wp-discourse-to-discourse/223490#granular-api-key-new-sparkles-6):
>
> After you’ve [installed the WP Discourse Plugin](https://meta.discourse.org/t/install-the-wp-discourse-plugin/223489) you need to connect it to your Discourse. When you’re ready to go, watch this short video, or follow the instructions below. Next Step Once the plugin is connected, head over to the topic describing the feature you want to set up: [Publish posts to Discourse](https://meta.discourse.org/t/wp-discourse-and-publishing-posts-to-discourse/223492)[Use Discourse for Wordpress Comments](https://meta.discourse.org/t/wp-discourse-and-commenting/223493)[Log in to Discourse with Wordpress (DiscourseConnect)](https://meta.discourse.org/t/wp-discourse-and-discourseconnect/223494)Instructions Steps When you’re looking at the Connection tab of the [WP Discourse](https://github.com/discourse/wp-discourse) plugin settings,…
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [June 23, 2022, 4:35pm UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/14 "2022-06-23T16:35:19Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.