After looking into this, it appears pagure only show you're own API key: https://pagure.io/pagure/blob/master/f/pagure/templates/settings.html#_123

Might still be good to indicate this somewhere.

Bit confused on this one, what is the use case for a user using their User API key, and not wanting it to be used as them?

Maybe the real issue here is not having application keys for people wanting to make 3rd party applications that interface with pagure...

Pingou: good to know.

I feel there should be some more information about how the token authentication work. Maybe just adding These are your personal tokens, they are not visible to other owners of this repository. would be enough.

This is my thought process when trying to figure out the API usage: I wanted to add comments to PRs from a script. I generated the token and tested it on a repo where only I have access (to not spam anyone else). It worked fine. Then I wanted to adapt the script to another repo, which has another owner (the original creator of the repo). At this point I became unsure as to how the token works. I had two theories:

• the token is tied to person who created it – this seems to be the case currently, and makes most sense to me; i.e. the comments will show up as coming from me
• the token is tied to creator of the repo – the comments will show up as coming from the original owner, which is undesirable

The description in the settings page did not help me much, so I tried it out and it works as I think it should.

I think your text is the correct way to fix this :)

I have opened a PR #800 to add the text.

PR #800 has been merged, thanks @lsedlar :)

Closing this ticket :)