# Welche Scopes benötigt der Wordpress API-Schlüssel genau?

**URL:** <https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812>\
**Category:** WordPress\
**Created:** [11. Januar 2021 um 20:57 UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812 "2021-01-11T20:57:39Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![angus](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/angus/32/341715_2.png) [@angus](https://meta.discourse.org/u/angus)\
**Post date:** [18. April 2022 um 13:07 UTC](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812/12 "2022-04-18T13:07:24Z")

</div>

Nur eine kurze Notiz, dass der Discourse-Teil davon zur Überprüfung eingereicht wurde (d. h. aus dem Entwurf verschoben wurde).

> <https://github.com/discourse/discourse/pull/15366>
>
> I'm looking to add granular API key usage for the WP Discourse plugin. This invo…lves:
> 
> \- Updating the "wordpress" default mappings to reflect the actions being used by the plugin, grouped by the feature-set they relate to (note that the existing "wordpress" action in the "topic" resource only relates to comment retrieval in the plugin, and is somewhat confusing in its current state).
> \- Adding a \`\`session/scopes\`\` endpoint, which returns the scopes associated with the api key in the request.
> 
> This is the companion PR on the plugin, which will provide further context to this: https://github.com/discourse/wp-discourse/pull/431. See in particular \[\`\`validate\_scopes\`\`\](https://github.com/discourse/wp-discourse/pull/431/files#diff-5fd9ce264afeb5f617119db36e34a2e5a33f605527ac6fa9ee761b8123f1a17eR185).
> 
> If this approach is acceptable, I'll do some more testing before moving this out of draft. Below are some Q/A explaining my thinking behind this.
> 
> \### Why does the wordpress plugin need granular scopes?
> 
> Currently the plugin requires the use of a global key, but only uses a subset of the actions, creating more risk than necessary. \[See for example\](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812).
> 
> \### Why group the scopes by feature set?
> 
> This is how people use the plugin. Some use only SSO, some only publishing, some without comments etc. If a user is not using SSO they should be able to use a key that doesn't include the \`\`admin/user\`\` actions SSO requires.
> 
> Currently the "publishing" feature set cannot be totally disabled in the plugin (hence the "(required)" in the action description), however the ability to disable it (and just use SSO) may be added.
> 
> \### Why add a \`\`session/scopes\`\` endpoint?
> 
> The WP Discourse plugin currently sends a request to \`\`/users/:username\`\` to test its connection to Discourse. This may be successful even if the allowed scopes are insufficient for how the plugin is configured. 
> 
> A scopes endpoint tells the API consumer both whether the connection is successful and what scopes their key has. There's similar implementations in other APIs, e.g \[Sendgrid\](https://docs.sendgrid.com/api-reference/api-key-permissions/retrieve-a-list-of-scopes-for-which-this-user-has-access).
> 
> \### Why add the \`\`scopes\`\` endpoint to the session controller?
> 
> The endpoint could go in a few different places. I figured it belonged there as essentially you're asking about the scopes in the session created when the api-authenticated request is made.
> 
> \### Why not use a \`\`tokeninfo\`\` endpoint?
> 
> \`\`tokeninfo\`\` endpoints are part of the OAuth 2.0 spec, which is not what we're dealing with here. Using it may be confusing.

Sobald dieser zusammengeführt wurde, kann der [WP Discourse](https://github.com/discourse/wp-discourse)-Teil zusammengeführt und veröffentlicht werden.

---

_[View the full topic](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812)._