---
type: api
title: Clone an API key
description: **All methods and paths for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-security-clone-api-key
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/operation/operation-security-clone-api-key
products:
  - Elasticsearch
---

# Clone an API key


Availability: 9.4+

## Paths

- `POST` (also `PUT`) `/_security/api_key/clone`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#basicauth)
- [Bearer auth](/elastic/docs-builder/docs/4371/api/doc/elasticsearch/v9/authentication#bearerauth)

## Description

Create a copy of an existing API key with a new ID.
The cloned key inherits the role descriptors of the source key.
This is intended for applications (such as Kibana) that need to
create API keys on behalf of a user using an existing API key credential,
since derived API keys (API keys created by API keys) are not otherwise supported.

## Required authorization

* Cluster privileges: `clone_api_key`

## Query String Parameters

- `refresh` (enum Refresh)
  If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.
  Values: `true`, `false`, `wait_for`

## Request Body

`application/json`

- `api_key` (string) — required
  The credentials of the API key to clone.
This is the secret value returned when the key was originally created.
- `name` (string Name) — optional
  A name for the cloned API key.
If not provided, the name of the source key is used.
- `expiration` (string Duration) — optional
  The expiration time for the cloned API key.
By default, API keys never expire.
Set to `null` to explicitly create a key with no expiration.
- `metadata` (Metadata) — optional
  Arbitrary metadata to associate with the cloned API key.
It supports nested data structure.
Within the metadata object, keys beginning with `_` are reserved for system usage.

## Response

`application/json`

- `api_key` (string)
  The generated API key value for the cloned key.
- `expiration` (number)
  Expiration in milliseconds for the API key.
- `id` (string Id)
  The unique ID of the cloned API key.
- `name` (string Name)
  The name of the cloned API key.
- `encoded` (string)
  API key credentials which is the base64-encoding of
the UTF-8 representation of `id` and `api_key` joined
by a colon (`:`).
## Code Examples

#### Console

```console
PUT /_security/api_key/clone
```

#### curl

```curl
curl -X PUT "/_security/api_key/clone"
```