# Authentication working with username/password but not with API key

**URL:** https://discuss.elastic.co/t/authentication-working-with-username-password-but-not-with-api-key/280108
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [July 31, 2021, 5:12am UTC](https://discuss.elastic.co/t/authentication-working-with-username-password-but-not-with-api-key/280108 "2021-07-31T05:12:15Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![abhinavkulkarni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhinavkulkarni/32/91428_2.png) [@abhinavkulkarni](https://discuss.elastic.co/u/abhinavkulkarni)
#### Post date: [July 31, 2021, 5:12am UTC](https://discuss.elastic.co/t/authentication-working-with-username-password-but-not-with-api-key/280108/1 "2021-07-31T05:12:15Z")

</div>

Hi,

I have set up a self-managed 3-node Elasticsearch cluster on Kubernetes using instructions [here](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-deploy-elasticsearch.html). I haven't yet added any extra bells and whistles, but pretty much used the YAML in the link.

I am able to cURL for various endpoints such as `/_cluster/health` using username and password, but now with an API key I generated.

I generated the API key as follows:

```auto
POST /_security/api_key
{
  "name": "my-api-key",
  "expiration": "365d", 
  "role_descriptors": { 
    "role-b": {
      "cluster": ["all"],
      "index": [
        {
          "names": ["*"],
          "privileges": ["all"]
        }
      ]
    }
  }
}

```

I then generated the credentials using

```bash
CREDENTIALS=$(echo "${API_ID}:${API_KEY}" | base64)

```

I then used the credentials to query for cluster health as follows (please note I'm using `-k` flag):

```bash
curl -H "Authorization: ApiKey $CREDENTIALS" -k https://${CLUSTER_IP}:${CLUSTER_PORT}/_cluster/health

```

I get the following error:

```bash
{"error":{"root_cause":[{"type":"security_exception","reason":"missing authentication credentials for REST request [/_cluster/health]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}}],"type":"security_exception","reason":"missing authentication credentials for REST request [/_cluster/health]","header":{"WWW-Authenticate":["Basic realm=\"security\" charset=\"UTF-8\"","Bearer realm=\"security\"","ApiKey"]}},"status":401}

```

Please note that if I use `-u $USERNAME:$PASSWORD` option for authorization, it does work.

I think this has to do with xpack security and certificates, etc.

Can somebody please opine?

Thanks!

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [July 31, 2021, 6:15am UTC](https://discuss.elastic.co/t/authentication-working-with-username-password-but-not-with-api-key/280108/2 "2021-07-31T06:15:49Z")

</div>

Well one thing I see from the example.

> echo -n "VuaCfGcBCdbkQm-e5aOx:ui2lp2axTNmsyakw9tvNnw" | base64
> 
> Use **`-n`** so that the `echo` command doesn’t print the trailing newline character

Also have you tried it without a without the environment variables substitution just putting it all in the curl command.

I don't think the -k it's treated any difference and when using username and password vs API key.

---

<div class="post-metadata">

### Author: ![abhinavkulkarni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/abhinavkulkarni/32/91428_2.png) [@abhinavkulkarni](https://discuss.elastic.co/u/abhinavkulkarni)
#### Post date: [August 4, 2021, 3:14pm UTC](https://discuss.elastic.co/t/authentication-working-with-username-password-but-not-with-api-key/280108/3 "2021-08-04T15:14:00Z")

</div>

Thanks, I missed the `-n` flag.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 1, 2021, 3:14pm UTC](https://discuss.elastic.co/t/authentication-working-with-username-password-but-not-with-api-key/280108/4 "2021-09-01T15:14:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.