diff --git a/modules/rest_api.py b/modules/rest_api.py
index 0bccb793..b4c35565 100644
--- a/modules/rest_api.py
+++ b/modules/rest_api.py
@@ -23,7 +23,8 @@ class Handler(http.server.BaseHTTPRequestHandler):
             hook = hooks[0]
             authenticated = hook.get_kwarg("authenticated", True)
             key = params.get("key", None)
-            permissions = _bot.get_setting("api-key-%s" % key, [])
+            key_setting = = _bot.get_setting("api-key-%s" % key, {})
+            permissions = key_seting.get("permissions", [])
 
             if not authenticated or path in permissions or "*" in permissions:
                 if path.startswith("/api/"):