[role="xpack"]
[[api-keys]]
=== API Keys


API keys enable you to create secondary credentials so that you can send
requests on behalf of a user. Secondary credentials have
the same or lower access rights.

For example, if you extract data from an {es} cluster on a daily
basis, you might create an API key tied to your credentials,
configure it with minimum access,
and then put the API credentials into a cron job.
Or, you might create API keys to automate ingestion of new data from
remote sources, without a live user interaction.

To manage API keys, open the main menu, then click *Stack Management > API Keys*.

[role="screenshot"]
image:images/api-keys.png["API Keys UI"]

[float]
[[api-keys-security-privileges]]
=== Security privileges

You must have the `manage_security`, `manage_api_key`, or the `manage_own_api_key` 
cluster privileges to use API keys in {kib}.  API keys can also be seen in a readonly view with access to the page and the `read_security` cluster privilege. To manage roles, open the main menu, then click 
*Stack Management > Roles*, or use the <<role-management-api, {kib} Role Management API>>. 


[float]
[[create-api-key]]
=== Create an API key

To create an API key, open the main menu, then click *Stack Management > API Keys > Create API key*.

[role="screenshot"]
image:images/create-api-key.png["Create API Key UI"]

Once created, you can copy the API key (Base64 encoded) and use it to send requests to {es} on your behalf. For example:

[source,bash]
curl --location --request GET 'http://localhost:5601/api/security/role' \
--header 'Content-Type: application/json;charset=UTF-8' \
--header 'kbn-xsrf: true' \
--header 'Authorization: ApiKey aVZlLUMzSUJuYndxdDJvN0k1bU46aGxlYUpNS2lTa2FKeVZua1FnY1VEdw==' \


[IMPORTANT]
============================================================================
API keys are intended for programmatic access to {kib} and {es}. Do not use API keys to authenticate access via a web browser.
============================================================================

[float]
[[udpate-api-key]]
=== Update an API key

To update an API key, open the main menu, click *Stack Management > API Keys*, and then click on the name of the key.

You can only update the `Restrict privileges` and `metadata` fields.

[float]
[[view-api-keys]]
=== View and delete API keys

The *API Keys* feature in Kibana lists your API keys, including the name, date created, and status. If an API key expires, its status changes from `Active` to `Expired`.

If you have `manage_security` or `manage_api_key` permissions,
you can view the API keys of all users, and see which API key was
created by which user in which realm.
If you have only the `manage_own_api_key` permission, you see only a list of your own keys.

You can delete API keys individually or in bulk.
