# Code comment says "We don't support admin api keys yet" - is this true?

**URL:** <https://forum.ghost.org/t/code-comment-says-we-dont-support-admin-api-keys-yet-is-this-true/6344>\
**Category:** Developer help\
**Created:** [March 19, 2019, 1:34pm UTC](https://forum.ghost.org/t/code-comment-says-we-dont-support-admin-api-keys-yet-is-this-true/6344 "2019-03-19T13:34:51Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![grant](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/grant/32/3721_2.png) [@grant](https://forum.ghost.org/u/grant)\
**Post date:** [March 19, 2019, 1:34pm UTC](https://forum.ghost.org/t/code-comment-says-we-dont-support-admin-api-keys-yet-is-this-true/6344/1 "2019-03-19T13:34:51Z")

</div>

Details:

- What’s your URL? [https://grantwinney.com](https://grantwinney.com)
- What version of Ghost are you using? Ghost-CLI version: 1.9.9 / Ghost version: 2.18.1
- What configuration? self-hosted _(?)_
- What browser? Brave - Version 0.61.51 Chromium: 73.0.3683.75 (Official Build) (64-bit)
- What errors or information do you see in the console? _error below_
- What steps could someone else take to reproduce the issue you’re having? _my steps are below_

* * *

I’m trying to experiment with the Admin API, and I _think_ I’m authenticating correctly with an Admin API Key id/secret, but I’m unable to actually authenticate.

> missingAdminUserOrIntegration: “Unable to determine the authenticated user or integration. Check that cookies are being passed through if using session authentication.”

Looking at the code, I see [this comment](https://github.com/TryGhost/Ghost/blob/ac26436c104f3df594e07313fa9cb191415be5d2/core/server/services/auth/authorize.js#L72) on the code:

> We don’t support admin api keys yet, but we can already use this authorization helper, because we have not connected authenticating with admin api keys yet. `req.api_key` will be always null.

Is the comment outdated, or (the way I interpret it) can we only authenticate with the Admin API via username/password right now, and not an Admin API Key?

If the comment’s outdated, then I guess I’m just doing something wrong. 😕

* * *

This probably won’t mean a ton to anyone, but here’s how I’m trying to authenticate in C#, using the [Jwt.Net](https://github.com/jwt-dotnet/jwt) library.

```csharp
var adminKeyParts = adminApiKey.Split(':');

var unixEpochInSeconds = new DateTimeOffset(DateTime.Now).ToUnixTimeSeconds();

var token = new JwtBuilder().WithAlgorithm(new HMACSHA256Algorithm())
                            .WithSecret(StringToByteArray(adminKeyParts[1]))
                            .AddHeader(HeaderName.KeyId, adminKeyParts[0])
                            .AddClaim("exp", unixEpochInSeconds + 300)
                            .AddClaim("iat", unixEpochInSeconds)
                            .AddClaim("aud", "/v2/admin/")
                            .Build();

var request = new RestRequest($"posts/{id}", Method.GET);
request.AddHeader("Authorization", $"Ghost {token}");
var response = Client.Execute<PostResponse>(request);
return response.Data;

...
...

public static byte[] StringToByteArray(string hex)
{
    int NumberChars = hex.Length;
    byte[] bytes = new byte[NumberChars / 2];
    for (int i = 0; i < NumberChars; i += 2)
        bytes[i / 2] = Convert.ToByte(hex.Substring(i, 2), 16);
    return bytes;
}

```

---

<div class="post-metadata">

**Author:** ![John](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/john/32/29288_2.png) [@John](https://forum.ghost.org/u/John)\
**Post date:** [March 19, 2019, 1:42pm UTC](https://forum.ghost.org/t/code-comment-says-we-dont-support-admin-api-keys-yet-is-this-true/6344/2 "2019-03-19T13:42:50Z")

</div>

Please share the details of your install, in particular Ghost-version, when asking for help - rather than deleting the whole template which we created asking for those details.

Not much anyone here can suggest unless you share context

---

<div class="post-metadata">

**Author:** ![grant](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/grant/32/3721_2.png) [@grant](https://forum.ghost.org/u/grant)\
**Post date:** [March 19, 2019, 2:03pm UTC](https://forum.ghost.org/t/code-comment-says-we-dont-support-admin-api-keys-yet-is-this-true/6344/3 "2019-03-19T14:03:03Z")

</div>

Absolutely, sorry about that. My question was more about whether the comment was accurate or outdated, but I’ve added the details.

---

<div class="post-metadata">

**Author:** ![Kevin](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/kevin/32/32_2.png) [@Kevin](https://forum.ghost.org/u/Kevin)\
**Post date:** [March 19, 2019, 2:03pm UTC](https://forum.ghost.org/t/code-comment-says-we-dont-support-admin-api-keys-yet-is-this-true/6344/4 "2019-03-19T14:03:08Z")

</div>

The comment is definitely outdated, thanks for pointing it out!

As for the error, it’s suggesting that the `kid` header value doesn’t match any known integration key. I would try capturing the generated token and pasting it into the debugger at [https://jwt.io](https://jwt.io) to verify it matches what you expect, if it does then maybe check the URL that you’re connecting to.

---

<div class="post-metadata">

**Author:** ![grant](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/grant/32/3721_2.png) [@grant](https://forum.ghost.org/u/grant)\
**Post date:** [March 19, 2019, 2:18pm UTC](https://forum.ghost.org/t/code-comment-says-we-dont-support-admin-api-keys-yet-is-this-true/6344/5 "2019-03-19T14:18:57Z")

</div>

Wow, that site’s awesome.

Everything seemed okay, based on when I created the token earlier.

```auto
{
  "kid": "expected id",
  "typ": "JWT",
  "alg": "HS256"
}

{
  "exp": 1553004583, // 300 seconds after current time
  "iat": 1553004283, // current time
  "aud": "/v2/admin/"
}

```

The URL seems okay too…

> [https://grantwinney.com/ghost/api/v2/admin/posts/{valid\_post\_id}](https://grantwinney.com/ghost/api/v2/admin/posts/%7Bvalid_post_id%7D)

I’ll keep playing around with it… it’ll probably be obvious once I figure it out. 🙂

---

<div class="post-metadata">

**Author:** ![Kevin](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/kevin/32/32_2.png) [@Kevin](https://forum.ghost.org/u/Kevin)\
**Post date:** [March 19, 2019, 2:33pm UTC](https://forum.ghost.org/t/code-comment-says-we-dont-support-admin-api-keys-yet-is-this-true/6344/6 "2019-03-19T14:33:27Z")

</div>

> [@grant](#):
>
> The URL seems okay too…
> 
> > [https://grantwinney.com/ghost/api/v2/admin/posts/{valid\_post\_id}](https://grantwinney.com/ghost/api/v2/admin/posts/%7Bvalid_post_id%7D)

Don’t forget that URLs must end with a `/` - if the trailing slash isn’t there then Ghost will respond with a 301, perhaps your networking library isn’t forwarding the same headers if it’s following the redirect?

---

<div class="post-metadata">

**Author:** ![grant](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/grant/32/3721_2.png) [@grant](https://forum.ghost.org/u/grant)\
**Post date:** [March 19, 2019, 2:49pm UTC](https://forum.ghost.org/t/code-comment-says-we-dont-support-admin-api-keys-yet-is-this-true/6344/7 "2019-03-19T14:49:09Z")

</div>

Wow, that was it. Thanks Kevin.

I didn’t expect that because I use the same URL format without the trailing slash for the Content API (except `/ghost/api/v2/content/` instead of `/ghost/api/v2/admin/`) and it always returns the correct results. I’ll make sure I add the trailing slash with both APIs from now on. 👍

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/2X/b/ba9ce5100b8bb264586f4f572545596b2ce3f081.png) [@system](https://forum.ghost.org/u/system)\
**Post date:** [April 2, 2019, 2:49pm UTC](https://forum.ghost.org/t/code-comment-says-we-dont-support-admin-api-keys-yet-is-this-true/6344/8 "2019-04-02T14:49:10Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.