# How to get SSWS {{apikey}} and roles? **URL:** \ **Category:** Questions\ **Tags:** api, java\ **Created:** [September 2, 2022, 11:52am UTC](https://devforum.okta.com/t/how-to-get-ssws-apikey-and-roles/21766 "2022-09-02T11:52:30Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Jvalekar](https://avatars.discourse-cdn.com/v4/letter/j/96bed5/32.png) [@Jvalekar](https://devforum.okta.com/u/Jvalekar)\ **Post date:** [September 2, 2022, 11:52am UTC](https://devforum.okta.com/t/how-to-get-ssws-apikey-and-roles/21766/1 "2022-09-02T11:52:30Z")
Hello All, I am new to Okta and I have okta sandbox details only. Can anyone please tell me where I get the roles for a particular user and how can i get the API key for the SSWS {{apikey}} for the postman? ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [September 7, 2022, 8:37pm UTC](https://devforum.okta.com/t/how-to-get-ssws-apikey-and-roles/21766/2 "2022-09-07T20:37:52Z")
You can call [/api/v1/users/${userId}/roles](https://developer.okta.com/docs/reference/api/roles/#list-roles-assigned-to-a-user) to list the admin roles for a user. An SSWS API key cannot be generated via an API call, you must [generate it in the UI](https://developer.okta.com/docs/guides/create-an-api-token/main/) (while logged in as the admin user in question, of course). If you need something more programmatic, you may want to considering using OAuth to authorize the calls to Okta instead. More details here: [Implement OAuth for Okta | Okta Developer](https://developer.okta.com/docs/guides/implement-oauth-for-okta/main/) and [Implement OAuth for Okta with a service app | Okta Developer](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/) ---
**Author:** ![Jvalekar](https://avatars.discourse-cdn.com/v4/letter/j/96bed5/32.png) [@Jvalekar](https://devforum.okta.com/u/Jvalekar)\ **Post date:** [September 8, 2022, 7:37am UTC](https://devforum.okta.com/t/how-to-get-ssws-apikey-and-roles/21766/3 "2022-09-08T07:37:17Z")
Thanks, @andrea for the response. I am using authorization code flow with the PKCE method and I received the access token as well, but when I want to make calls for another APIS, I need an API key in the header. I tried with the access token key but got an unauthorized token error. So not sure what is the main reason for it. ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [September 8, 2022, 4:16pm UTC](https://devforum.okta.com/t/how-to-get-ssws-apikey-and-roles/21766/4 "2022-09-08T16:16:41Z")
If the user’s access token has high [enough admin privileges](https://help.okta.com/en-us/Content/Topics/Security/administrators-admin-comparison.htm) to make the request (for /roles, they would need to be an admin that is allowed to read users), then you can add the access token to the auth header as a Bearer token (e.g, change it from `SSWS {{apikey}}` to `Bearer {{access_token}}`). End-users without admin permissions will not be able to access this information with their access token ---
**Author:** ![AlexandreUnca](https://avatars.discourse-cdn.com/v4/letter/a/a9adbd/32.png) [@AlexandreUnca](https://devforum.okta.com/u/AlexandreUnca)\ **Post date:** [July 3, 2023, 8:54am UTC](https://devforum.okta.com/t/how-to-get-ssws-apikey-and-roles/21766/5 "2023-07-03T08:54:16Z")
This is what i am trying to do. Do how do i get the bearer of the user. My front angular only send me the Auth bearer with no scopes. I am building my api in dotnet core. to get the accestoken i am doing something like this : this.Request.Headers[HeaderNames.Authorization] and this as scope : Scopes = new HashSet { “okta.users.read”, “okta.apps.read”, “okta.users.manage” } But when i try to call await uapi.ListUsers().ToListAsync(), i dont get any result. ---
**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\ **Post date:** [July 6, 2023, 8:17pm UTC](https://devforum.okta.com/t/how-to-get-ssws-apikey-and-roles/21766/6 "2023-07-06T20:17:55Z")
And you’re getting back an Access Token with the requested scopes, issued by the Org Authorization Server (`iss` == your Okta domain)? Are you using one of our SDKs to get the token and then make the request to Users, or is this your own code? ---
**Author:** ![AlexandreUnca](https://avatars.discourse-cdn.com/v4/letter/a/a9adbd/32.png) [@AlexandreUnca](https://devforum.okta.com/u/AlexandreUnca)\ **Post date:** [July 9, 2023, 8:36am UTC](https://devforum.okta.com/t/how-to-get-ssws-apikey-and-roles/21766/7 "2023-07-09T08:36:04Z")
cf : [How to lock down an API token to only access what our application needs - #13 by AlexandreUnca](https://devforum.okta.com/t/how-to-lock-down-an-api-token-to-only-access-what-our-application-needs/14305/13) I do use okta skd. ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [February 13, 2024, 1:00am UTC](https://devforum.okta.com/t/how-to-get-ssws-apikey-and-roles/21766/8 "2024-02-13T01:00:33Z")
Closed on February 13, 2024, 1:00am UTC This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.