# Using tokens with the endpoint /internal/security/login for logging instead of basic authentication **URL:** https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909 **Category:** Kibana **Tags:** elastic-stack-security **Created:** [December 30, 2020, 6:55pm UTC](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909 "2020-12-30T18:55:30Z") **Posts on this page:** 1 **Showing post:** 3
### Author: ![DMinovski](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@DMinovski](https://discuss.elastic.co/u/DMinovski) #### Post date: [December 31, 2020, 9:59am UTC](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909/3 "2020-12-31T09:59:15Z")
@azasypkin, I'm using version 7.10.1 of the stack, Kibana is connected to cloud Elasticsearch hosted by [https://elastic.co](https://elastic.co). I'm loading dashboards in iFrames. The verification works, but the username and password are available in the HTML code. Using tokens, if possible, will improve security. I'm using the `index.html` code from here, but the data object in the big brackets is replaced with the one in the link in the opening post of this topic: > [@Hitting Security API Endpoint](https://discuss.elastic.co/t/hitting-security-api-endpoint/241952/8): > > Alright, I got something to work. I'm probably not going to list out every single step I did, but I found an IIS solution that worked for me. Sorry if you use Apache or NGinX. I'm not familiar with those web servers so I can't help there. You must have a valid SSL Cert for IIS and IIS must be installed on the same server that your ELK stack is installed on. You may be able to spin up a free trial of this on an Azure VM and use Let's Encrypt to get an SSL Cert (or perhaps Azure has a way to let … According to the schema here, it should be possible to use tokens: > [@Kibana 7.10 login issues](https://discuss.elastic.co/t/kibana-7-10-login-issues/255201/3): > > Hey @KevSex, Yeah, as @flash1293 already noted, it's an internal API and we reserve the right to make any breaking changes to it even though we try hard to not do that without a strong need. Back to your original question, [here is the definition](https://github.com/elastic/kibana/blob/v7.10.0/x-pack/plugins/security/server/routes/authentication/common.ts#L122-L135) of request body schema: schema.object({ providerType: schema.string(), providerName: schema.string(), currentURL: schema.string(), params: schema.conditional( schema.siblingRef('providerType'), schema.oneOf([ schema.literal(Basic… --- _[View the full topic](https://discuss.elastic.co/t/using-tokens-with-the-endpoint-internal-security-login-for-logging-instead-of-basic-authentication/259909)._