# Is it possible to use secrets from Elasticsearch keystore in ES Watcher actions?

**URL:** https://discuss.elastic.co/t/is-it-possible-to-use-secrets-from-elasticsearch-keystore-in-es-watcher-actions/292755
**Category:** Elasticsearch
**Tags:** elastic-stack-alerting
**Created:** [December 23, 2021, 3:20am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-secrets-from-elasticsearch-keystore-in-es-watcher-actions/292755 "2021-12-23T03:20:15Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![andrewthetack](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewthetack/32/99462_2.png) [@andrewthetack](https://discuss.elastic.co/u/andrewthetack)
#### Post date: [December 23, 2021, 3:20am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-secrets-from-elasticsearch-keystore-in-es-watcher-actions/292755/1 "2021-12-23T03:20:15Z")

</div>

I use watchers that call custom webhooks in their actions sections. Can I refer keystore values in the Authorization headers similar to variables?

I need something similar to:

```auto
"actions": {
    "my-api-notification": {
      "webhook": {
        "scheme": "https",
        "host": "api.example.com",
        "port": 443,
        "method": "post",
        "path": "/v1/es-alerts",
        "headers": {
          "Authorization": "KEY {{api_key.secret.staging}}",
          "Content-Type": "application/json"
        },

```

where "api\_key.secret.staging" is the name of the keystore field?

This didn't work in my case. Maybe you can suggest other options for storing shared secrets.

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [December 23, 2021, 4:08am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-secrets-from-elasticsearch-keystore-in-es-watcher-actions/292755/2 "2021-12-23T04:08:02Z")

</div>

Hi @andrewthetack Welcome to the community!

Hmmm

EDIT : Actually... As I reread I think you're right. Here's a very important sentence. It looks like only `password` is supported

> Also be aware, that there is no way to configure your own fields in a watch to be encrypted.

> **[Encrypting sensitive data in Watcher | Elasticsearch Guide \[7.16\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.16/encrypting-data.html)**

Perhaps someone else has an idea..

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 20, 2022, 4:08am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-secrets-from-elasticsearch-keystore-in-es-watcher-actions/292755/3 "2022-01-20T04:08:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
