Create a service account token

POST also PUT /_security/service/{namespace}/{service}/credential/token/{name}
POST /_security/service/{namespace}/{service}/credential/token

Create a service accounts token for access without requiring basic authentication.

NOTE: Service account tokens never expire. You must actively delete them if they are no longer needed.

IMPORTANT: On Serverless, non-operator users can create tokens for only elastic/fleet-server and elastic/fleet-server-remote. Creating tokens for any other service account requires operator privileges.

Required authorization

Cluster privileges: manage_service_account

More about service accounts

Path Parameters

Query Parameters

refresh enum Refresh: If true (the default) then refresh the affected shards to make this operation visible to search, if wait_for then wait for a refresh to make this operation visible to search, if false then do nothing with refreshes.; Values: true false wait_for

Response

application/json

Examples

A successful response from POST /_security/service/elastic/fleet-server/credential/token/token1. The response includes the service account token, its name, and its secret value as a bearer token.

Request Console 1 / 8 languages

Console Kibana Dev Tools

POST /_security/service/elastic/fleet-server/credential/token/token1

JavaScript Elasticsearch JavaScript Client

const response = await client.security.createServiceToken({
  namespace: "elastic",
  service: "fleet-server",
  name: "token1",
});

Python Elasticsearch Python Client

resp = client.security.create_service_token(
    namespace="elastic",
    service="fleet-server",
    name="token1",
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_security/service/elastic/fleet-server/credential/token/token1" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"

Java Elasticsearch Java Client

client.security().createServiceToken(c -> c
    .name("token1")
    .namespace("elastic")
    .service("fleet-server")
);

C# Elasticsearch .NET Client

var response = await client.Security
    .CreateServiceTokenAsync(new CreateServiceTokenRequest()
    {
        Name = "token1",
        Namespace = "elastic",
        Service = "fleet-server"
    });

PHP Elasticsearch PHP Client

$resp = $client->security()->createServiceToken([
    "namespace" => "elastic",
    "service" => "fleet-server",
    "name" => "token1",
]);

Ruby Elasticsearch Ruby Client

response = client.security.create_service_token(
  namespace: "elastic",
  service: "fleet-server",
  name: "token1"
)

Response

{
  "created": true,
  "token": {
    "name": "token1",
    "value": "AAEAAWVsYXN0aWM...vZmxlZXQtc2VydmVyL3Rva2VuMTo3TFdaSDZ" 
  }
}

Required authorization

Path Parameters { namespace , service , name , }

Query Parameters

Response

Path Parameters