# How to use keystore for basic auth password for the input watch
**URL:** https://discuss.elastic.co/t/how-to-use-keystore-for-basic-auth-password-for-the-input-watch/132227
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [May 16, 2018, 10:50pm UTC](https://discuss.elastic.co/t/how-to-use-keystore-for-basic-auth-password-for-the-input-watch/132227 "2018-05-16T22:50:10Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@Doug\_Nelson1](https://discuss.elastic.co/u/Doug_Nelson1)
#### Post date: [May 16, 2018, 10:50pm UTC](https://discuss.elastic.co/t/how-to-use-keystore-for-basic-auth-password-for-the-input-watch/132227/1 "2018-05-16T22:50:10Z")
Looking for an example of showing how to set the basic auth password using a keystore when using an http input for the watcher. Looking for an example watch http input that uses a keystore to avoid having the user password in the watch in plain text.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [May 17, 2018, 7:11am UTC](https://discuss.elastic.co/t/how-to-use-keystore-for-basic-auth-password-for-the-input-watch/132227/2 "2018-05-17T07:11:11Z")
Hey,
you cannot use the keystore for this currently. You can however ensure that the password is not stored in plaintext in elasticsearch by using the `xpack.watcher.encrypt_sensitive_data: true` setting, See [the docs here](https://www.elastic.co/guide/en/x-pack/6.2/encrypting-data.html)
hope this helps!
--Alex
---
### Author:  [@Doug\_Nelson1](https://discuss.elastic.co/u/Doug_Nelson1)
#### Post date: [May 17, 2018, 10:48am UTC](https://discuss.elastic.co/t/how-to-use-keystore-for-basic-auth-password-for-the-input-watch/132227/3 "2018-05-17T10:48:24Z")
So the passwords are still in plain text in the watch script and this will prevent the password from being displayed in the watcher history if I am reading this correctly.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [May 17, 2018, 11:06am UTC](https://discuss.elastic.co/t/how-to-use-keystore-for-basic-auth-password-for-the-input-watch/132227/4 "2018-05-17T11:06:51Z")
No. The password is sent in plaintext to the Put Watch API, but before the watch is stored in the `.watches` index it is encrypted using the system key (and decrypted when needed, i.e. during execution).
We did a couple of changes, which will be available with the 6.3.0 release, to ensure that no credentials are leaked in the watcher history (remove authorization headers for example).
---
### Author:  [@Doug\_Nelson1](https://discuss.elastic.co/u/Doug_Nelson1)
#### Post date: [May 17, 2018, 11:24am UTC](https://discuss.elastic.co/t/how-to-use-keystore-for-basic-auth-password-for-the-input-watch/132227/5 "2018-05-17T11:24:45Z")
Thanks for the clarification Alex. Since many people are putting watches in source control, there is a need to be able to not have the password in the watch in plain text. Glad to see the credentials will no longer be leaked into the watcher history. Would really be nice if keystores were supported as this would be a good way to solve this.
---
### Author:  [@spinscale](https://discuss.elastic.co/u/spinscale)
#### Post date: [May 17, 2018, 12:40pm UTC](https://discuss.elastic.co/t/how-to-use-keystore-for-basic-auth-password-for-the-input-watch/132227/6 "2018-05-17T12:40:26Z")
That is an absolute valid requirement. Do you mind opening an issue in [https://github.com/elastic/elasticsearch/](https://github.com/elastic/elasticsearch/) (thanks to the x-pack merge we can now manage those kind of things in the ES repo).
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 14, 2018, 12:40pm UTC](https://discuss.elastic.co/t/how-to-use-keystore-for-basic-auth-password-for-the-input-watch/132227/7 "2018-06-14T12:40:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.