# Authentication using apikey failed **URL:** \ **Category:** Kibana\ **Created:** [May 14, 2021, 9:00pm UTC](https://discuss.elastic.co/t/authentication-using-apikey-failed/273066 "2021-05-14T21:00:56Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![nfarmer](https://avatars.discourse-cdn.com/v4/letter/n/9de053/32.png) [@nfarmer](https://discuss.elastic.co/u/nfarmer)\ **Post date:** [May 14, 2021, 9:00pm UTC](https://discuss.elastic.co/t/authentication-using-apikey-failed/273066/1 "2021-05-14T21:00:56Z")
So I recently had to reset my ELK stack, because I was having crazy issues I couldn't fix. Without realizing it, and after looking at the logs, I saw that also killed all of my api keys. [2021-05-14T20:39:26,217][WARN][o.e.x.s.a.AuthenticationService] [server.local] Authentication using apikey failed - unable to find apikey with id asdfghjkl My question is, is there anyway to restore my api keys with the exact same id, name, and apikey? Or is there anyway of figuring out what machines are trying to authenticate with a specific apikey? ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [May 17, 2021, 2:27pm UTC](https://discuss.elastic.co/t/authentication-using-apikey-failed/273066/2 "2021-05-17T14:27:31Z")
You won't be able to have the same ID/name/apikey sadly. So the best solution will be to just go through the setup of all API keys again from scratch, to make sure you don't miss anything. It will save you a lot of hunting when you have one that's missing or something else. ---
**Author:** ![nfarmer](https://avatars.discourse-cdn.com/v4/letter/n/9de053/32.png) [@nfarmer](https://discuss.elastic.co/u/nfarmer)\ **Post date:** [May 17, 2021, 2:31pm UTC](https://discuss.elastic.co/t/authentication-using-apikey-failed/273066/3 "2021-05-17T14:31:06Z")
Okay, thanks! Is there anyway to discover what hosts are trying to connect using the specific APIs? ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [May 17, 2021, 2:32pm UTC](https://discuss.elastic.co/t/authentication-using-apikey-failed/273066/4 "2021-05-17T14:32:22Z")
You should be able to find them in the audit logs: [Audit logs | Kibana Guide [7.12] | Elastic](https://www.elastic.co/guide/en/kibana/current/xpack-security-audit-logging.html) ---
**Author:** ![nfarmer](https://avatars.discourse-cdn.com/v4/letter/n/9de053/32.png) [@nfarmer](https://discuss.elastic.co/u/nfarmer)\ **Post date:** [May 17, 2021, 5:29pm UTC](https://discuss.elastic.co/t/authentication-using-apikey-failed/273066/5 "2021-05-17T17:29:49Z")
I ensured logging was enabled on both elasticsearch and kibana (it was). and I'm seeing `[2021-05-17T16:52:32,685][WARN][o.e.x.s.a.AuthenticationService] [graylog.scspa.local] Authentication using apikey failed - unable to find apikey with id DEyW3HUBgMTKE8dJsmBi` (this is one of many) but no indication what machine attempted the connection ---
**Author:** ![nfarmer](https://avatars.discourse-cdn.com/v4/letter/n/9de053/32.png) [@nfarmer](https://discuss.elastic.co/u/nfarmer)\ **Post date:** [May 19, 2021, 1:08pm UTC](https://discuss.elastic.co/t/authentication-using-apikey-failed/273066/6 "2021-05-19T13:08:00Z")
@Marius_Dragomir Any ideas as to how I can get the actual IPs of who/what is attempting a connection? ---
**Author:** ![Marius\_Dragomir](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marius_dragomir/32/42087_2.png) [@Marius\_Dragomir](https://discuss.elastic.co/u/Marius_Dragomir)\ **Post date:** [June 14, 2021, 1:27pm UTC](https://discuss.elastic.co/t/authentication-using-apikey-failed/273066/7 "2021-06-14T13:27:15Z")
other than using a proxy in front of your ES instance and looking in those logs, there isn't any way. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 12, 2021, 1:27pm UTC](https://discuss.elastic.co/t/authentication-using-apikey-failed/273066/8 "2021-07-12T13:27:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.