# APM java agent and api\_key
**URL:** https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244
**Category:** APM
**Tags:** java, server
**Created:** [August 17, 2020, 1:59pm UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244 "2020-08-17T13:59:32Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@GershonA](https://discuss.elastic.co/u/GershonA)
#### Post date: [August 17, 2020, 1:59pm UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244/1 "2020-08-17T13:59:32Z")
Hello All,
I'm using elastic cloud service (7.8) and want to allow
> elastic-apm-agent-1.18.0.RC1
to use API key instead of secret\_token
So, I create the key as following:
```auto
POST /_security/api_key
{
"name": "my-api-key",
"expiration": "1d",
"role_descriptors": {
"apm-privileges": {
"cluster": ["all"],
"index": [
{
"names": ["apm*"],
"privileges": ["all"]
}
]
}
}
}
```
Then I create a role:
```auto
PUT /_security/role/apm-privileges
{
"applications": [{
"application": "apm",
"privileges": ["sourcemap:write", "event:write", "config_agent:read"],
"resources": ["*"]
}]
}
```
The key was base64 encoded (id:api\_key)
```auto
echo -n 'XXXXXXX:XXXXXXXX' | base64
```
Now I try to use it as following:
```auto
java -javaagent:"C:\Users\xxxxx\Downloads\elastic-apm-agent-1.18.0.RC1.jar" \
-Delastic.apm.service_name=apm \
-Delastic.apm.server_url=https://XXXXXXXXXXX.apm.us-east-1.aws.cloud.es.io:443 \
-Delastic.apm.application_packages=org.example \
-Delastic.apm.elastic.apm.environment=int \
-Delastic.apm.transaction_sample_rate=1.0 \
-Delastic.apm.elastic.apm.capture_body=OFF \
-Delastic.apm.elastic.apm.api_key="XXXXXXXXXXXXXXXX==" \
-jar target/hello-world-rest-api.jar
```
Error:
```auto
2020-08-17 16:33:43,894 [elastic-apm-server-reporter] ERROR co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Error sending data to APM server: cannot retry due to server authentication, in streaming mode, response code is 401
```
The same work well if I use
`-Delastic.apm.secret_token=XXXXXXX`
instead of
` -Delastic.apm.elastic.apm.api_key="XXXXXXXXXXXXXXXX==`
Thank You!
---
### Author:  [@simitt](https://discuss.elastic.co/u/simitt)
#### Post date: [August 17, 2020, 2:57pm UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244/2 "2020-08-17T14:57:51Z")
Hi @GershonA,
please create the role and assign the required privileges to the user requesting to create the API Key _before_ creating the API Key.
When creating the API Key try the following request body for assigning all APM privileges:
```auto
POST /_security/api_key
{
"name": "apm-api-key",
"expiration": "1d",
"role_descriptors": {
"apm-privileges": {
"applications": [
{"application": "apm",
"privileges": ["sourcemap:write", "event:write", "config_agent:read"],
"resources": ["*"]}
]
}
}
}
```
---
### Author:  [@GershonA](https://discuss.elastic.co/u/GershonA)
#### Post date: [August 18, 2020, 7:19am UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244/3 "2020-08-18T07:19:56Z")
Thank You for answer.
I did all from scratch, with wide permission range as **superuser**.
So, the role is:
Then I create the key as following:
```auto
POST /_security/api_key
{
"name": "apm-api-key",
"expiration": "1d",
"role_descriptors": {
"apm-privileges": {
"applications": [
{"application": "MyApp",
"privileges": ["all"],
"resources": ["*"]}
]
}
}
}
```
Response:
```auto
{
"id" : "ER9lAHQBljG9hC72XUFY",
"name" : "apm-api-key",
"expiration" : 1597820877122,
"api_key" : "RHHkxzJZRM2MuNgDuwGoTQ"
}
```
Then I encode the id:key
```auto
echo -n 'ER9lAHQBljG9hC72XUFY:RHHkxzJZRM2MuNgDuwGoTQ' | base64
RVI5bEFIUUJsakc5aEM3MlhVRlk6UkhIa3h6SlpSTTJNdU5nRHV3R29UUQ==
```
Trying:
```auto
java -javaagent:"C:\Users\XXXXXX\Downloads\elastic-apm-agent-1.18.0.RC1.jar" \
-Delastic.apm.service_name=MyApp \
-Delastic.apm.server_url=https://XXXXXXXXXX.apm.us-east-1.aws.cloud.es.io:443 \
-Delastic.apm.application_packages=org.example \
-Delastic.apm.elastic.apm.environment=int \
-Delastic.apm.transaction_sample_rate=1.0 \
-Delastic.apm.elastic.apm.capture_body=OFF \
-Delastic.apm.elastic.apm.api_key="RVI5bEFIUUJsakc5aEM3MlhVRlk6UkhIa3h6SlpSTTJNdU5nRHV3R29UUQ==" \
-jar target/hello-world-rest-api.jar
```
Same authentication problem
```auto
2020-08-18 10:15:52,091 [elastic-apm-server-reporter] ERROR co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Error sending data to APM server: cannot retry due to server authentication, in streaming mode, response code is 401
```
Where I'm wrong?
Thank You for help!
---
### Author:  [@simitt](https://discuss.elastic.co/u/simitt)
#### Post date: [August 18, 2020, 11:08am UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244/4 "2020-08-18T11:08:17Z")
Hi @GershonA,
I see that you have changed the code snippet I shared - please change `application` back to `apm` and `privileges` to `"sourcemap:write", "event:write", "config_agent:read"`.
Regarding the roles and permissions, if you are sending the request as a superuser you do not need to assign the additional role, otherwise please ensure the user has the previously mentioned role with the [APM application API Key privileges](https://www.elastic.co/guide/en/apm/server/7.8/api-key.html#create-api-key-subcommands) assigned.
Do not share any valid API Key tokens in a public forum (and in case it happens ensure to immediately invalidate them).
Let me know if this helps.
---
### Author:  [@GershonA](https://discuss.elastic.co/u/GershonA)
#### Post date: [August 18, 2020, 2:36pm UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244/5 "2020-08-18T14:36:09Z")
Thank You for trying help me.
Suggested solution not working for superuser and regular user as well.
Steps:
1. role created:
```auto
PUT /_security/role/apm-privileges {
"applications": [{
"application": "apm",
"privileges": ["sourcemap:write", "event:write", "config_agent:read"],
"resources": ["*"]
}]
}
```
1. API Key created
```auto
POST /_security/api_key
{
"name": "apm-api-key",
"expiration": "1d",
"role_descriptors": {
"apm-privileges": {
"applications": [
{"application": "apm",
"privileges": ["sourcemap:write", "event:write", "config_agent:read"],
"resources": ["*"]}
]
}
}
}
```
1. id:api\_key encoded
2.
```auto
java -javaagent:"C:\Users\xxxxx\Downloads\elastic-apm-agent-1.18.0.RC1.jar" \
-Delastic.apm.service_name=apm \
-Delastic.apm.server_url=https://XXXXXXXXXXX.apm.us-east-1.aws.cloud.es.io:443 \
-Delastic.apm.application_packages=org.example \
-Delastic.apm.elastic.apm.environment=int \
-Delastic.apm.transaction_sample_rate=1.0 \
-Delastic.apm.elastic.apm.capture_body=OFF \
-Delastic.apm.elastic.apm.api_key="(base 64 encoded id:api_key)" \
-jar target/hello-world-rest-api.jar
```
1. Same 401 error
---
### Author:  [@simitt](https://discuss.elastic.co/u/simitt)
#### Post date: [August 18, 2020, 3:23pm UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244/6 "2020-08-18T15:23:21Z")
When using above listed snippet with a superuser to create the API Key I can succesfully ingest data with it. For locating the issue, would you mind trying a manual request against your APM Server and check whether the request is allowed or not. You can download some [testdata.ndjson](https://www.elastic.co/guide/en/apm/server/7.8/example-intake-events.html) and make a request like:
`curl -i -H "Content-type: application/x-ndjson" -H "Authorization: ApiKey your-base-64-encoded-key" --data-binary @testdata.ndjson /intake/v2/events`
If this returns a `202` it would mean that the issue is probably on the java agent side;
if you get a `401` either the key is invalid or API Keys are not enabled in the APM Server. In this case please verify that
- the user creating the API Key has expected privileges by running following query (with this user logged into Kibana), expecting the response to return `true` for every privilege.
```auto
GET /_security/user/_has_privileges
{
"application": [
{
"application": "apm",
"privileges" : ["sourcemap:write", "event:write", "config_agent:read"],
"resources" : ["*"]
}
]
}
```
- check that API Key usage is enabled by ensuring `apm-server.api_key.enabled=true` (default case in Elastic Cloud, if you have not overwritten it in the user settings section it is set to true).
---
### Author:  [@GershonA](https://discuss.elastic.co/u/GershonA)
#### Post date: [August 19, 2020, 7:40am UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244/7 "2020-08-19T07:40:54Z")
Hello,
I did as suggested.
1. With superuser i get return `202`
2. With the apm user `202` as well
3. From user Kubana:
```auto
{
"username" : "apm_test_user",
"has_all_requested" : true,
"cluster" : { },
"index" : { },
"application" : {
"apm" : {
"*" : {
"sourcemap:write" : true,
"event:write" : true,
"config_agent:read" : true
}
}
}
}
```
1. From application:
```auto
2020-08-19 10:04:28,303 [main] INFO co.elastic.apm.agent.util.JmxUtils - Found JVM-specific OperatingSystemMXBean interface: com.sun.management.OperatingSystemMXBean
2020-08-19 10:04:28,558 [main] INFO co.elastic.apm.agent.configuration.StartupInfo - Starting Elastic APM 1.18.0.RC1 as apm on Java 11.0.8 Runtime version: 11.0.8+10-LTS VM version: 11.0.8+10-LTS (Oracle Corporation) Windows
10 10.0
2020-08-19 10:04:31,408 [main] INFO co.elastic.apm.agent.impl.ElasticApmTracer - Tracer switched to RUNNING state
2020-08-19 10:04:31,836 [elastic-apm-server-healthcheck] INFO co.elastic.apm.agent.report.ApmServerHealthChecker - Elastic APM server is available:
2020-08-19 10:04:31,840 [elastic-apm-server-healthcheck] WARN co.elastic.apm.agent.report.ApmServerHealthChecker - Failed to parse version of APM server https://xxx.apm.us-east-1.aws.cloud.es.io:443/: Unexpected end of JSON inpu
```
---
### Author:  [@Sylvain\_Juge](https://discuss.elastic.co/u/Sylvain_Juge)
#### Post date: [August 19, 2020, 9:41am UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244/8 "2020-08-19T09:41:18Z")
Hi @GershonA,
This line in the logs seems to indicate that there is an issue communicating with server, could you provide us debug logs with `log_level=debug` (see [logging troubleshooting doc](https://www.elastic.co/guide/en/apm/agent/java/current/trouble-shooting.html#trouble-shooting-logging) for reference )
> [@GershonA](#):
>
> `Failed to parse version of APM server https://xxx.apm.us-east-1.aws.cloud.es.io:443/: Unexpected end of JSON inpu`
---
### Author:  [@GershonA](https://discuss.elastic.co/u/GershonA)
#### Post date: [August 19, 2020, 10:03am UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244/9 "2020-08-19T10:03:29Z")
Hello,
I added following line:
`-Delastic.apm.elastic.apm.log_level=DEBUG `
The error was not changed
```auto
2020-08-19 12:55:02,295 [main] INFO co.elastic.apm.agent.util.JmxUtils - Found JVM-specific OperatingSystemMXBean interface: com.sun.management.OperatingSystemMXBean
2020-08-19 12:55:02,494 [main] INFO co.elastic.apm.agent.configuration.StartupInfo - Starting Elastic APM 1.18.0.RC1 as apm on Java 11.0.8 Runtime version: 11.0.8+10-LTS VM version: 11.0.8+10-LTS (Oracle Corporation) Windows
10 10.0
2020-08-19 12:55:02,506 [main] WARN co.elastic.apm.agent.configuration.StartupInfo - To enable all features and decrease startup time, please configure application_packages
2020-08-19 12:55:04,557 [main] INFO co.elastic.apm.agent.impl.ElasticApmTracer - Tracer switched to RUNNING state
2020-08-19 12:55:05,545 [elastic-apm-server-healthcheck] INFO co.elastic.apm.agent.report.ApmServerHealthChecker - Elastic APM server is available:
2020-08-19 12:55:05,549 [elastic-apm-server-healthcheck] WARN co.elastic.apm.agent.report.ApmServerHealthChecker - Failed to parse version of APM server https://xxx.apm.us-east-1.aws.cloud.es.io:443/: Unexpected end of JSON input
2020-08-19 12:55:05,550 [elastic-apm-remote-config-poller] ERROR co.elastic.apm.agent.configuration.ApmServerConfigurationSource - Unexpected status 401 while fetching configuration
```
---
### Author:  [@Sylvain\_Juge](https://discuss.elastic.co/u/Sylvain_Juge)
#### Post date: [August 21, 2020, 8:26am UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244/10 "2020-08-21T08:26:51Z")
With a 401 status code, it means there is likely an issue with the api key value, thus just to be sure could you check the agent configuration option value ?
When you generate an API key, you will get a result similar to:
```auto
{
"id" : "XXXXXXXXXXXXXXXXXX",
"name" : "apm-backend",
"api_key" : "YYYYYYYYYYYYYYY"
}
```
You seem to be using windows, but with Linux/bash the instructions to compute the base64 value for API key is the following:
```auto
echo -n 'XXXXXXXXXXXXXXXXXX:YYYYYYYYYYYYYYY' | base64
# this will return WFhYWFhYWFhYWFhYWFhYWFhYOllZWVlZWVlZWVlZWVlZWQ==
```
Here the `-n` option is really important otherwise an `EOL` character is included.
---
### Author:  [@GershonA](https://discuss.elastic.co/u/GershonA)
#### Post date: [August 24, 2020, 8:26am UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244/11 "2020-08-24T08:26:19Z")
Hello Sylvain\_Juge,
I try to run this from windows WSL.
And my ked encoded as suggested:
```auto
echo -n 'XXXXXXXXXXXXXXXXXX:YYYYYYYYYYYYYYY' | base64
```
Unfortunately, the same nasty 401 ☹
Thank You!
---
### Author:  [@Sylvain\_Juge](https://discuss.elastic.co/u/Sylvain_Juge)
#### Post date: [August 31, 2020, 9:43am UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244/12 "2020-08-31T09:43:02Z")
Do you still have the issue ?
Your server url was reported in the logs (I've since redacted it), and trying to reach it with `curl` triggered a 502 error, thus I wasn't able to test it myself.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 21, 2020, 5:43am UTC](https://discuss.elastic.co/t/apm-java-agent-and-api-key/245244/13 "2020-09-21T05:43:03Z")
This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.