# User with manage\_own\_api\_key - Best Practices (Security) **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [November 7, 2021, 8:14am UTC](https://discuss.elastic.co/t/user-with-manage-own-api-key-best-practices-security/288559 "2021-11-07T08:14:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![inf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inf/32/85793_2.png) [@inf](https://discuss.elastic.co/u/inf)\ **Post date:** [November 7, 2021, 8:14am UTC](https://discuss.elastic.co/t/user-with-manage-own-api-key-best-practices-security/288559/1 "2021-11-07T08:14:10Z")
Hi, I have been using the default `elastic` user to create API keys. However, I do not think that this is a good security practice (please correct me if I'm wrong). Hence, I'm not sure how do others normally create API keys - do you guys have a dedicated user with just the `manage_own_api_key` cluster privilege (where it is used for creating API keys)? Or do you guys have a separate user from `elastic` which has this privilege, but with other privileges too for administration? (If it's the latter, which other privileges are advised to be grouped together?) Thank you! (P.S. The documentation for `Create API key API` is [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-api-key.html), for reference.) ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 8, 2021, 3:09am UTC](https://discuss.elastic.co/t/user-with-manage-own-api-key-best-practices-security/288559/2 "2021-11-08T03:09:16Z")
The answer will depend on what you're trying to use API Keys for. What is the problem that you're trying to solve with API Keys? ---
**Author:** ![inf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inf/32/85793_2.png) [@inf](https://discuss.elastic.co/u/inf)\ **Post date:** [November 8, 2021, 3:59am UTC](https://discuss.elastic.co/t/user-with-manage-own-api-key-best-practices-security/288559/3 "2021-11-08T03:59:30Z")
What I have in mind: Use a set of unique API keys to **setup various Beats** on different machines respectively (1 API key per beat, per machine), then using another set of unique API keys (with less permissions) for these **Beats to send documents** to my Elasticsearch cluster on a long-term basis. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [November 8, 2021, 5:36am UTC](https://discuss.elastic.co/t/user-with-manage-own-api-key-best-practices-security/288559/4 "2021-11-08T05:36:48Z")
In which case I would recommend creating a new user specifically for ingestion - e.g. `beats_ingest` - and then use that user to create API keys. The main reason for recommending this is that Elasticsearch considers an API key to be "owned" by the user that created it, and to be their responsibility. That means things like audit logs will say that the data was ingested by the owner of the API Key. It also means many of the management interfaces for API Keys (e.g. the Get/Query API Key endpoints, and the API Keys UI in Kibana) have capabilities to show API Keys specifically for a single user. Having a separate API key per machine is helpful because it allows you to separate credentials per machine and track which credential is ingesting which data, but it is better if you also group those API keys under a common user so that you can track what they're doing and manage them as a group. ---
**Author:** ![inf](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/inf/32/85793_2.png) [@inf](https://discuss.elastic.co/u/inf)\ **Post date:** [November 8, 2021, 9:05am UTC](https://discuss.elastic.co/t/user-with-manage-own-api-key-best-practices-security/288559/5 "2021-11-08T09:05:09Z")
Thanks! Greatly appreciate your reply. Just a quick one: Do you think it is a good idea to have a separate API key for different Beats within a machine itself? I understand that having a separate API key per machine is helpful. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 6, 2021, 9:05am UTC](https://discuss.elastic.co/t/user-with-manage-own-api-key-best-practices-security/288559/6 "2021-12-06T09:05:51Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.