# Unable to grant an API Key, request does not contain an authorization header
**URL:** https://discuss.elastic.co/t/unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/274956
**Category:** Kibana
**Tags:** elastic-stack-security, docker
**Created:** [June 4, 2021, 8:08am UTC](https://discuss.elastic.co/t/unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/274956 "2021-06-04T08:08:36Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)
#### Post date: [June 4, 2021, 8:08am UTC](https://discuss.elastic.co/t/unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/274956/1 "2021-06-04T08:08:36Z")
I have configured the ELK SIEM in Security Onion setup but while adding new rules (security\>detection\>manage detection rules\>create new rule\> create and activate rule) I am facing subjected error-
I can confirm [prerequisite](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html) are configured.
Here is my config-
elasticsearch.yml
```auto
{%- set NODE_ROUTE_TYPE = salt['pillar.get']('elasticsearch:node_route_type', 'hot') %}
{%- set NODEIP = salt['pillar.get']('elasticsearch:mainip') %}
{%- set TRUECLUSTER = salt['pillar.get']('elasticsearch:true_cluster', False) %}
{%- if TRUECLUSTER is sameas true %}
{%- set ESCLUSTERNAME = salt['pillar.get']('elasticsearch:true_cluster_name') %}
{%- else %}
{%- set ESCLUSTERNAME = salt['pillar.get']('elasticsearch:esclustername') %}
{%- endif %}
{%- set NODE_ROLES = salt['pillar.get']('elasticsearch:node_roles', ['data', 'ingest']) %}
cluster.name: "{{ ESCLUSTERNAME }}"
network.host: 0.0.0.0
path.logs: /var/log/elasticsearch
action.destructive_requires_name: true
transport.bind_host: 0.0.0.0
transport.publish_host: {{ grains.host }}
transport.publish_port: 9300
cluster.routing.allocation.disk.threshold_enabled: true
cluster.routing.allocation.disk.watermark.low: 95%
cluster.routing.allocation.disk.watermark.high: 98%
cluster.routing.allocation.disk.watermark.flood_stage: 98%
xpack.ml.enabled: false
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true
xpack.security.transport.ssl.verification_mode: none
xpack.security.transport.ssl.key: /usr/share/elasticsearch/config/elasticsearch.key
xpack.security.transport.ssl.certificate: /usr/share/elasticsearch/config/elasticsearch.crt
xpack.security.transport.ssl.certificate_authorities: ["/usr/share/elasticsearch/config/ca.crt"]
xpack.security.http.ssl.enabled: true
xpack.security.http.ssl.client_authentication: none
xpack.security.http.ssl.key: /usr/share/elasticsearch/config/elasticsearch.key
xpack.security.http.ssl.certificate: /usr/share/elasticsearch/config/elasticsearch.crt
xpack.security.http.ssl.certificate_authorities: /usr/share/elasticsearch/config/ca.crt
xpack.security.authc:
anonymous:
username: *del-uname*
roles: superuser
authz_exception: true
node.name: {{ grains.host }}
script.max_compilations_rate: 1000/1m
{%- if TRUECLUSTER is sameas true %}
{%- if grains.role == 'so-manager' %}
{%- if salt['pillar.get']('nodestab', {}) %}
node.roles: [master, data, remote_cluster_client]
discovery.seed_hosts:
- {{ grains.master }}
{%- for SN, SNDATA in salt['pillar.get']('nodestab', {}).items() %}
- {{ SN.split('_')|first }}
{%- endfor %}
{%- endif %}
{%- else %}
node.roles: {{ NODE_ROLES }}
node.attr.box_type: {{ NODE_ROUTE_TYPE }}
discovery.seed_hosts:
- {{ grains.master }}
{%- endif %}
{%- endif %}
{%- if TRUECLUSTER is sameas false %}
node.attr.box_type: {{ NODE_ROUTE_TYPE }}
{%- endif %}
indices.query.bool.max_clause_count: 1500
```
kibana.yml
```auto
{%- set ES = salt['pillar.get']('manager:mainip', '') -%}
server.name: kibana
server.host: "0"
server.basePath: /kibana
elasticsearch.hosts: ["https://{{ ES }}:9200"]
elasticsearch.ssl.verificationMode: none
xpack.encryptedSavedObjects.encryptionKey: *del_key*
xpack.reporting.encryptionKey: *del_key*
xpack.security.encryptionKey: *del_key*
elasticsearch.requestTimeout: 90000
logging.dest: /var/log/kibana/kibana.log
telemetry.enabled: false
security.showInsecureClusterWarning: false
xpack.security.authc.providers:
anonymous.anonymous1:
order: 0
credentials: "del"
```
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [June 4, 2021, 8:29am UTC](https://discuss.elastic.co/t/unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/274956/2 "2021-06-04T08:29:12Z")
It looks like you're using anonymous authentication to Kibana is that correct?
Can you also confirm what version of Kibana you are using?
---
### Author:  [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)
#### Post date: [June 4, 2021, 8:55am UTC](https://discuss.elastic.co/t/unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/274956/3 "2021-06-04T08:55:39Z")
yes it is anonymous authentication.
```auto
xpack.security.authc:
anonymous:
```
Kibana version 7.11.2
---
### Author:  [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)
#### Post date: [June 4, 2021, 9:57am UTC](https://discuss.elastic.co/t/unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/274956/4 "2021-06-04T09:57:48Z")
Nothing wrong with anonymous authentication right?
---
### Author:  [@Larry\_Gregory](https://discuss.elastic.co/u/Larry_Gregory)
#### Post date: [June 4, 2021, 11:21am UTC](https://discuss.elastic.co/t/unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/274956/5 "2021-06-04T11:21:12Z")
Hey @Nil_Battey_Sannata, how are your credentials defined for anonymous access? If you're using an API Key, then this is an expected limitation. You can tell if you're using an API Key if your auth provider is configured in either of the following ways:
```auto
xpack.security.authc.providers:
anonymous.anonymous1:
order: 0
credentials:
apiKey: your_key_here
```
```auto
xpack.security.authc.providers:
anonymous.anonymous1:
order: 0
credentials:
apiKey.id: your_key_id
apiKey.key: your_key_secret
```
If you're using either of those configurations, can you try switching to the username/password format instead, and let us know if that works?
```auto
xpack.security.authc.providers:
anonymous.anonymous1:
order: 0
credentials:
username: your_anonymous_username
password: your_anonymous_password
```
---
### Author:  [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)
#### Post date: [June 4, 2021, 2:13pm UTC](https://discuss.elastic.co/t/unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/274956/6 "2021-06-04T14:13:25Z")
This is current authentication config. It has credentials and not API key.
elasticsearch.yml
```auto
xpack.security.authc:
anonymous:
username: uname
roles: superuser
authz_exception: true
```
kibana.yml
```auto
xpack.security.authc.providers:
anonymous.anonymous1:
order: 0
credentials: "elasticsearch_anonymous_user"
```
---
### Author:  [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)
#### Post date: [June 4, 2021, 5:47pm UTC](https://discuss.elastic.co/t/unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/274956/7 "2021-06-04T17:47:58Z")
Hi @Larry_Gregory Can you please take a look at config?
---
### Author:  [@Nil\_Battey\_Sannata](https://discuss.elastic.co/u/Nil_Battey_Sannata)
#### Post date: [June 5, 2021, 8:48am UTC](https://discuss.elastic.co/t/unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/274956/8 "2021-06-05T08:48:05Z")
This solved my problem. Thanks for support!
```auto
credentials:
username: your_anonymous_username
password: your_anonymous_password
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 3, 2021, 8:48am UTC](https://discuss.elastic.co/t/unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/274956/9 "2021-07-03T08:48:36Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.