# After creating API key attempting to use it results in: missing authentication credentials for REST request

**URL:** <https://discuss.elastic.co/t/after-creating-api-key-attempting-to-use-it-results-in-missing-authentication-credentials-for-rest-request/217266>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [January 30, 2020, 7:57pm UTC](https://discuss.elastic.co/t/after-creating-api-key-attempting-to-use-it-results-in-missing-authentication-credentials-for-rest-request/217266 "2020-01-30T19:57:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![scarby](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scarby/32/61788_2.png) [@scarby](https://discuss.elastic.co/u/scarby)\
**Post date:** [January 30, 2020, 7:57pm UTC](https://discuss.elastic.co/t/after-creating-api-key-attempting-to-use-it-results-in-missing-authentication-credentials-for-rest-request/217266/1 "2020-01-30T19:57:20Z")

</div>

Hope someone can help here

i'm attempting to create api keys for a user and utilize them as documented here:  
[https://www.elastic.co/guide/en/elasticsearch/reference/7.5/security-api-create-api-key.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/security-api-create-api-key.html)

i have successfully created the api key however when i attempt to curl anything as documented in the elastic search docs i.e.:

```auto
curl -k https://<censored>:9200/_cluster/health -H 'Authorization: ApiKey <censored>='

```

i am greeted with the following response:

```auto
{"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/_cluster/health]","header":{"WWW-Authenticate":["Bearer realm=\"security\"","ApiKey","Basic realm=\"security\" charset=\"UTF-8\""]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/_cluster/health]","header":{"WWW-Authenticate":["Bearer realm=\"security\"","ApiKey","Basic realm=\"security\" charset=\"UTF-8\""]}},"status":401}

```

I'm not sure why it would complain here given that i have apparently valid api token.

After doing some more digging i've noticed that i'm getting an invalid credentials error logged from elastic-search - the credentials are in fact correct and were pulled from the response using the following:

```auto
echo $(cat response | jq -r .id):$(cat response | jq -r .api_key) | base64

```

Incidentally if i intentionally use the wrong key id (in this case by including quotes) the following is logged

```auto
Authentication using apikey failed - unable to find apikey with id "fufe928Bnl45U--l7GCn"

```

so seemingly elasticsearch is finding the key but failing to grant access for other reasons

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [January 31, 2020, 10:36am UTC](https://discuss.elastic.co/t/after-creating-api-key-attempting-to-use-it-results-in-missing-authentication-credentials-for-rest-request/217266/2 "2020-01-31T10:36:11Z")

</div>

Which version is this on @scarby , is this reproducible with other API keys too ?

---

<div class="post-metadata">

**Author:** ![scarby](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/scarby/32/61788_2.png) [@scarby](https://discuss.elastic.co/u/scarby)\
**Post date:** [January 31, 2020, 4:15pm UTC](https://discuss.elastic.co/t/after-creating-api-key-attempting-to-use-it-results-in-missing-authentication-credentials-for-rest-request/217266/3 "2020-01-31T16:15:50Z")

</div>

@ikakavas 7.5.0 - deployed using the kubernetes operator

and yes, i am not able to auth using any api key i have created. I have tried multiple - both with and without roledefinitions explicitly specified

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [February 3, 2020, 8:19am UTC](https://discuss.elastic.co/t/after-creating-api-key-attempting-to-use-it-results-in-missing-authentication-credentials-for-rest-request/217266/4 "2020-02-03T08:19:40Z")

</div>

@scarby your `echo` needs the `-n` flag, otherwise it adds a newline to the string to be base64 encoded and the produced API Key is wrong.

i.e. , assuming you have a response like

```auto
{"id":"uggYCnABMV990shiRGts","name":"myname","api_key":"g8x2HywBS2iS1jbmJv4pNw"}

```

Now,

```auto
echo $(cat response | jq -r .id):$(cat response | jq -r .api_key) | base64

```

gives you

```auto
dWdnWUNuQUJNVjk5MHNoaVJHdHM6Zzh4Mkh5d0JTMmlTMWpibUp2NHBOdwo=

```

while

```auto
echo -n $(cat response | jq -r .id):$(cat response | jq -r .api_key) | base64

```

gives you

```auto
dWdnWUNuQUJNVjk5MHNoaVJHdHM6Zzh4Mkh5d0JTMmlTMWpibUp2NHBOdw==

```

The latter is the ApiKey value you want and decodes to:

```auto
$ echo "dWdnWUNuQUJNVjk5MHNoaVJHdHM6Zzh4Mkh5d0JTMmlTMWpibUp2NHBOdw==" | base64 -d | cat -vE

uggYCnABMV990shiRGts:g8x2HywBS2iS1jbmJv4pNw

```

while the former decodes to

```auto
$ echo "dWdnWUNuQUJNVjk5MHNoaVJHdHM6Zzh4Mkh5d0JTMmlTMWpibUp2NHBOdwo=" | base64 -d | cat -vE

uggYCnABMV990shiRGts:g8x2HywBS2iS1jbmJv4pNw$

```

(mind the trailing $)

HTH

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 2, 2020, 8:19am UTC](https://discuss.elastic.co/t/after-creating-api-key-attempting-to-use-it-results-in-missing-authentication-credentials-for-rest-request/217266/5 "2020-03-02T08:19:44Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.