diff --git a/humbug/urls.py b/humbug/urls.py
index b2c25617d8..8c046495bb 100644
--- a/humbug/urls.py
+++ b/humbug/urls.py
@@ -31,6 +31,10 @@ urlpatterns = patterns('',
     url(r'^api/v1/subscribe$', 'zephyr.views.api_subscribe', name='api_subscribe'),
     url(r'^api/v1/send_message$', 'zephyr.views.api_send_message', name='api_send_message'),
 
+    # This is an unformatted view used by clients before using the API.
+    # It requires username/password GET parameters.
+    url(r'^api/v1/fetch_api_key$', 'zephyr.views.api_fetch_key', name='api_fetch_key'),
+
     url(r'^robots\.txt$', 'django.views.generic.simple.redirect_to', {'url': '/static/public/robots.txt'}),
     url(r'^static/(?P<path>.*)$', 'django.views.static.serve',
         {'document_root': os.path.join(settings.SITE_ROOT, '../zephyr/static-access-control')}),
diff --git a/zephyr/views.py b/zephyr/views.py
index 9929f0dbb3..3d67de12d8 100644
--- a/zephyr/views.py
+++ b/zephyr/views.py
@@ -2,7 +2,7 @@ from django.conf import settings
 from django.contrib.auth import authenticate, login
 from django.contrib.auth.decorators import login_required
 from django.core.urlresolvers import reverse
-from django.http import HttpResponse, HttpResponseRedirect, HttpResponseBadRequest
+from django.http import HttpResponse, HttpResponseRedirect, HttpResponseBadRequest, HttpResponseForbidden
 from django.shortcuts import render_to_response
 from django.template import RequestContext
 from django.shortcuts import render
@@ -599,3 +599,16 @@ def json_stream_exists(request):
         return json_error("Invalid characters in stream name")
     exists = bool(get_stream(stream, UserProfile.objects.get(user=request.user).realm))
     return json_success({"exists": exists})
+
+def api_fetch_key(request):
+    try:
+        username = request.GET['username']
+        password = request.GET['password']
+    except KeyError:
+        return HttpResponseBadRequest("You must specify the username and password via GET.")
+    user = authenticate(username=username, password=password)
+    if user is None:
+        return HttpResponseForbidden("Your username or password is incorrect.")
+    if not user.is_active:
+        return HttpResponseForbidden("Your account has been disabled.")
+    return HttpResponse(user.userprofile.api_key)