# What are the privileges needed to create APM API key?
**URL:** https://discuss.elastic.co/t/what-are-the-privileges-needed-to-create-apm-api-key/230372
**Category:** APM
**Tags:** server
**Created:** [April 29, 2020, 1:09pm UTC](https://discuss.elastic.co/t/what-are-the-privileges-needed-to-create-apm-api-key/230372 "2020-04-29T13:09:49Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ffknob](https://discuss.elastic.co/u/ffknob)
#### Post date: [April 29, 2020, 1:09pm UTC](https://discuss.elastic.co/t/what-are-the-privileges-needed-to-create-apm-api-key/230372/1 "2020-04-29T13:09:49Z")
Hi
I'm setting an APM server up. Need some help with the API keys configuration...
This is what I did so far:
1. Created a role with the privileges listed in the docs. (notice the last one, the `apm_api_key`)
```auto
POST /_security/role/apm_setup
{
"cluster": [
"monitor",
"manage_ilm"
],
"indices": [
{
"names": [
"apm-*"
],
"privileges": [
"manage"
]
}
]
}
POST /_security/role/apm_monitoring
{
"cluster": [
"monitor"
],
"indices": [
{
"names": [
".monitoring-beats-*"
],
"privileges": [
"create_index",
"create_doc"
]
}
]
}
POST /_security/role/apm_writer
{
"cluster": [
"monitor",
"manage_ilm"
],
"indices": [
{
"names": [
"apm-*"
],
"privileges": [
"create_index",
"view_index_metadata",
"create_doc"
]
}
]
}
POST /_security/role/apm_reader
{
"indices": [
{
"names": [
"apm-*"
],
"privileges": [
"read"
]
}
]
}
PUT _security/role/apm_api_key
{
"applications": [
{
"application": "apm",
"privileges": [
"sourcemap:write",
"event:write",
"config_agent:read"
],
"resources": [
"*"
]
}
]
}
```
1. Assigned those roles to the `monitor` user.
2. ...but when I try to create the key:
```auto
$ ./apm-server apikey create --name apm-demo --ingest --sourcemap
{"error":{"root_cause":[{"type":"security_exception","reason":"action [cluster:admin/xpack/security/api_key/create] is unauthorized for user [monitor]"}],"type":"security_exception","reason":"action [cluster:admin/xpack/security/api_key/create] is unauthorized for user [monitor]"},"status":403}
```
What is missing?
---
### Author:  [@bmorelli25](https://discuss.elastic.co/u/bmorelli25)
#### Post date: [April 29, 2020, 3:15pm UTC](https://discuss.elastic.co/t/what-are-the-privileges-needed-to-create-apm-api-key/230372/2 "2020-04-29T15:15:38Z")
Hi Flavio,
Sorry for the confusion. We have an open issue to improve the documentation around required privileges for using API keys: [apm-server/3566](https://github.com/elastic/apm-server/issues/3566). You're missing the [`manage_api_key`](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-privileges.html) privilege on `cluster`.
Changing your `apm_api_key` role to include this privilege works on my end:
```
PUT _security/role/apm_api_key
{
"cluster": [
"manage_api_key"
],
"applications": [
{
"application": "apm",
"privileges": [
"sourcemap:write",
"event:write",
"config_agent:read"
],
"resources": [
"*"
]
}
]
}
```
---
### Author:  [@ffknob](https://discuss.elastic.co/u/ffknob)
#### Post date: [April 29, 2020, 4:18pm UTC](https://discuss.elastic.co/t/what-are-the-privileges-needed-to-create-apm-api-key/230372/3 "2020-04-29T16:18:39Z")
Thanks @bmorelli25 !
As a suggestion it would be nice if the error message could suggest just that: "User X unauthorized to Y. Maybe privilege Z missing?"
Elasticsearch has something like that when you have a mistake in your elasticsearch.yml.
Thanks for taking the time!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 20, 2020, 12:18pm UTC](https://discuss.elastic.co/t/what-are-the-privileges-needed-to-create-apm-api-key/230372/4 "2020-05-20T12:18:43Z")
This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.