API Users creates user accounts that exist only to hold an API key. An API user has no password and no email address, cannot log in, and is not shown to the public as a member.
It is for an administrator who wants a script, a monitor or an integration to act through the REST API as its own account, without that account also being a way into the forum.
A key that acts as a real member is only as safe as that member's account. If the account has a password, it can be guessed, phished or reset by email. If you hand the integration a super user key instead, it can do anything.
An API user is a real, valid account with its own permissions, so a key naming it can do exactly what you allow and nothing else, and there is no other way in to protect.
What an API user is:
- It cannot log in. It has its own authentication scheme, which refuses every password.
- It cannot be given a password or an email address. Both are refused wherever they are set: the user edit page, the REST API, a password reset, or another add-on.
- It is not a member to the public. It is left out of the member list, member counts, newest members, statistics and the username autocomplete.
- It has no public profile. Only the account itself and staff who can bypass user privacy can view it.
- It cannot follow anyone or be followed.
- It cannot be merged with another account, in either direction.
- It is still found in the control panel. User search and the username autocomplete both find it, and its edit page is marked.
An API user is recorded as one by this add-on. It is not identified by having no password, so the passwordless accounts XenForo creates itself, for a registration through a connected account, are left alone.
Hiding the account does not hide what it writes. An API user that creates a thread through the API is named on it, like any member.
![[BS] Live forum statistics - Xenforo 2](https://xenvn.com/data/attachments/2/2028-db6cb7fe4cbe91dce4e00025ee548042.jpg?hash=22y3_ky-kd){kind=small}
