---
title: "Known problems"
manual: "API_KEY"
version: "1.1"
permalink: "https://docs.typo3.org/permalink/maikschneider/api-key:known-problems@1.1"
source: "KnownProblems/Index.rst"
rendered: "2026-10-29T10:57:23+00:00"
---

# Known problems {#known-problems}

-   **Input of a rejected new key is lost**

    When a new key breaks a rule, FormEngine opens an empty form again. This is
    how FormEngine handles every record that DataHandler refuses to insert.
    An edit of an existing key that breaks a rule is dropped as a whole.

-   **Error messages carry a generic prefix**

    DataHandler wraps every save error in "This action could not be completed;
    please contact your administrator". The reason follows after "Technical
    details".

-   **Keys created without a backend session can't be shown**

    A key record created by DataHandler outside the backend, for example in a
    console command or an import, gets a hash but its secret is never shown.
    Use `apikey:create` on the command line.

-   **Backend users can't manage their own keys**

    Key records are admin only, and the module lives in the admin-only
    Integrations module.

-   **No rate limiting**

    Failed attempts are logged but not throttled. Limit requests in your web
    server or proxy for now
    ([#8](https://github.com/maikschneider/api-key/issues/8)).

-   **Bearer tokens behind Apache**

    See [Apache and the Authorization header](https://docs.typo3.org/permalink/maikschneider/api-key:security-apache@1.1).