Matthew Grasmick
--- a/ui/components/ConceptProver.jsx 0 → 100644
+++ b/ui/components/ConceptProver.jsx 0 → 100644
+      try {
+        const response = await fetch('/acquia-optimize/api/settings', {
+          method: 'GET',
+          credentials: 'same-origin',
+          headers: {
+            'Accept': 'application/json',
+          }
+        });
+
+        if (response.ok) {
+          const data = await response.json();
+          setCanConfigure(!!data.can_configure);
+          setCanScan(!!data.can_scan);
+
+          // If user doesn't have permission to scan or configure, don't proceed further
+          if (!data.can_scan && !data.can_configure) {
--- a/src/Controller/XbAcquiaOptimizeController.php 0 → 100644
+++ b/src/Controller/XbAcquiaOptimizeController.php 0 → 100644
+    );
+  }
+
+  /**
+   * Gets the Acquia Optimize settings.
+   *
+   * @return \Symfony\Component\HttpFoundation\JsonResponse
+   *   The JSON response containing settings.
+   */
+  public function getSettings(): JsonResponse {
+    $config = $this->configFactory->get('acquia_optimize.settings');
+    $hasAdminPermission = $this->currentUser()->hasPermission('administer acquia optimize');
+    $hasScanPermission = $this->currentUser()->hasPermission('scan acquia optimize');
+
+    $settings = [
+      'api_key' => $config->get('api_key') ? ($hasAdminPermission ? $config->get('api_key') : '[API key set]') : '',