# Authorization Header Login

**URL:** <https://discuss.elastic.co/t/authorization-header-login/361131>\
**Category:** Elastic Search\
**Created:** [June 10, 2024, 9:10am UTC](https://discuss.elastic.co/t/authorization-header-login/361131 "2024-06-10T09:10:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![GeorgeH](https://avatars.discourse-cdn.com/v4/letter/g/8edcca/32.png) [@GeorgeH](https://discuss.elastic.co/u/GeorgeH)\
**Post date:** [June 10, 2024, 9:10am UTC](https://discuss.elastic.co/t/authorization-header-login/361131/1 "2024-06-10T09:10:16Z")

</div>

Hi all, I'm wondering how I'd go about using the API Key Elasticsearch generates in order to use authorization header to gain access to ES.

I have a .HTML and .js file locally which contain iframes and logic to switch between the iframes to display dashboards at work. However, when using dashboards that are on Elasticsearch (using Kibana I believe), I get prompted with a login screen. I've used the login credentials to attempt to log in, only to be taken back to the login screen. I did some research (I'm new to web development) and most sources are saying about using an API Key and Authorization Header to gain access. I've got an API key from ES and the following JS code

```auto
const apiUrl = "https://example.com/";
const apiKey = "myKey";
fetch(apiUrl, {
  mode: 'no-cors',
  cache: 'no-cache',
  credentials: 'include',
  headers: {
    Authroization: `ApiKey ${apiKey}`
  },
})
.then(response => {
  if(!response.ok) {
    throw new Error('Network response was not okay...');
  }
  return response.json();
})
.then(protectedData => {
  console.log('Protected Data:', protectedData);
})
.catch(error => {
  console.error('Error: ', error);
});

```

Everytime I load the html page, chrome throws an error in the dev tools  
`GET https://example.com 401 (Unauthorized)`. The iframe shows the login page, but understandably, isn't logging me in.

Does anyone know of a solution for this? Any help would be gratefully appreciated!

---

<div class="post-metadata">

**Author:** ![Artem\_Shelkovnikov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artem_shelkovnikov/32/134322_2.png) [@Artem\_Shelkovnikov](https://discuss.elastic.co/u/Artem_Shelkovnikov)\
**Post date:** [June 10, 2024, 12:28pm UTC](https://discuss.elastic.co/t/authorization-header-login/361131/2 "2024-06-10T12:28:33Z")

</div>

Just to make sure - if `https://example.com` url of your Kibana, or your Elasticsearch?

It would make sense to see a login form if you would try to send your request to Kibana. Try using Elasticsearch address for your request instead.

---

<div class="post-metadata">

**Author:** ![GeorgeH](https://avatars.discourse-cdn.com/v4/letter/g/8edcca/32.png) [@GeorgeH](https://discuss.elastic.co/u/GeorgeH)\
**Post date:** [June 10, 2024, 1:15pm UTC](https://discuss.elastic.co/t/authorization-header-login/361131/3 "2024-06-10T13:15:39Z")

</div>

Thank you for responding. I'm pretty sure it's the URL for Elasticsearch.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 8, 2024, 1:15pm UTC](https://discuss.elastic.co/t/authorization-header-login/361131/4 "2024-07-08T13:15:43Z")

</div>

Closed on July 8, 2024, 1:15pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.