Create a service account token

POST also PUT /_security/service/{namespace}/{service}/credential/token/{name}
POST /_security/service/{namespace}/{service}/credential/token

Create a service accounts token for access without requiring basic authentication. This route serves both kinds of service account, but the privileges differ: manage_service_account authorizes tokens of built-in accounts in the elastic namespace only, and tokens of a user-managed account require manage_security.

Note

Service account tokens never expire. You must actively delete them if they are no longer needed.

Important

On Serverless, non-operator users can create tokens for only elastic/fleet-server and elastic/fleet-server-remote. Creating tokens for any other service account requires operator privileges.

More about service accounts

Required authorization

Authentication

Authorization: <value>

Elasticsearch APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example:

		curl -X GET "${ES_URL}/_cat/indices?v=true" \
  -H "Authorization: ApiKey ${API_KEY}"

For more information about where to find API keys for the Elasticsearch endpoint (${ES_URL}) for a project, go to Get started with Elasticsearch Serverless.

Request Console 1 / 8 languages

Console Kibana Dev Tools

POST /_security/service/elastic/fleet-server/credential/token/token1

JavaScript Elasticsearch JavaScript Client

const response = await client.security.createServiceToken({
  namespace: "elastic",
  service: "fleet-server",
  name: "token1",
});

Python Elasticsearch Python Client

resp = client.security.create_service_token(
    namespace="elastic",
    service="fleet-server",
    name="token1",
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_security/service/elastic/fleet-server/credential/token/token1" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"

Java Elasticsearch Java Client

client.security().createServiceToken(c -> c
    .name("token1")
    .namespace("elastic")
    .service("fleet-server")
);

C# Elasticsearch .NET Client

var response = await client.Security
    .CreateServiceTokenAsync(new CreateServiceTokenRequest()
    {
        Name = "token1",
        Namespace = "elastic",
        Service = "fleet-server"
    });

PHP Elasticsearch PHP Client

$resp = $client->security()->createServiceToken([
    "namespace" => "elastic",
    "service" => "fleet-server",
    "name" => "token1",
]);

Ruby Elasticsearch Ruby Client

response = client.security.create_service_token(
  namespace: "elastic",
  service: "fleet-server",
  name: "token1"
)

Response

A successful response from POST /_security/service/elastic/fleet-server/credential/token/token1. The response includes the service account token, its name, and its secret value as a bearer token.

{
  "created": true,
  "token": {
    "name": "token1",
    "value": "AAEAAWVsYXN0aWM...vZmxlZXQtc2VydmVyL3Rva2VuMTo3TFdaSDZ" 
  }
}

Create a service account token

Required authorization

Authentication

Path parameters

Query parameters

Response