# Create an API key in SSL curl

**URL:** <https://discuss.elastic.co/t/create-an-api-key-in-ssl-curl/318424>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [November 8, 2022, 11:16am UTC](https://discuss.elastic.co/t/create-an-api-key-in-ssl-curl/318424 "2022-11-08T11:16:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![diegz](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@diegz](https://discuss.elastic.co/u/diegz)\
**Post date:** [November 8, 2022, 11:16am UTC](https://discuss.elastic.co/t/create-an-api-key-in-ssl-curl/318424/1 "2022-11-08T11:16:14Z")

</div>

Hello,

I can't create an api key with the curl command in SSL.  
I have tried different command without success.  
Could you tell me the right command? And if I should authenticate with the node certificate or with the CA?

```auto
 curl --cert-type P12 --cert certs/node-1.p12:certpassword -XPOST "https://192.168.1.10:9200/_security/api_key?pretty" -u elastic:elasticpassword -H 'Content-Type: application/json' -d'
{
  "name": "my-api-key",   
  "role_descriptors": { 
    "role-a": {
      "cluster": ["all"],
      "index": [
        {
          "names": ["index-a*"],
          "privileges": ["read"]
        }
      ]
    },
    "role-b": {
      "cluster": ["all"],
      "index": [
        {
          "names": ["index-b*"],
          "privileges": ["all"]
        }
      ]
    }
  },
  "metadata": {
    "application": "my-application",
    "environment": {
       "level": 1,
       "trusted": true,
       "tags": ["dev", "staging"]
    }
  }
}
'

```

Best regards,

---

<div class="post-metadata">

**Author:** ![diegz](https://avatars.discourse-cdn.com/v4/letter/d/d07c76/32.png) [@diegz](https://discuss.elastic.co/u/diegz)\
**Post date:** [November 8, 2022, 1:55pm UTC](https://discuss.elastic.co/t/create-an-api-key-in-ssl-curl/318424/2 "2022-11-08T13:55:23Z")

</div>

I solved the problem by extracting the keys and cert from the client.p12 certificate and I also recovered the crt from the CA  
With this command it works:

```auto
curl -X POST --cacert "./elastic-stack-ca.crt" --cert "./node-1.crt" --key "./node-1.key" "https://192.168.1.10:9200/_security/api_key?pretty" -u elastic -H 'Content-Type: application/json' -d'
{
  "name": "my-api-key",   
  "role_descriptors": { 
    "role-a": {
      "cluster": ["all"],
      "index": [
        {
          "names": ["index-a*"],
          "privileges": ["read"]
        }
      ]
    },
    "role-b": {
      "cluster": ["all"],
      "index": [
        {
          "names": ["index-b*"],
          "privileges": ["all"]
        }
      ]
    }
  },
  "metadata": {
    "application": "my-application",
    "environment": {
       "level": 1,
       "trusted": true,
       "tags": ["dev", "staging"]
    }
  }
}
'

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 6, 2022, 1:56pm UTC](https://discuss.elastic.co/t/create-an-api-key-in-ssl-curl/318424/3 "2022-12-06T13:56:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.