---
type: api
title: Clone an API key
description: **All methods and paths for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch/operation/operation-security-clone-api-key
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/elasticsearch/operation/operation-security-clone-api-key
products:
  - Elasticsearch
---

# Clone an API key


Availability: Experimental since 9.4

## Paths

- `POST` (also `PUT`) `/_security/api_key/clone`

## Description

Create a copy of an existing API key with a new ID.
The cloned key inherits the role descriptors of the source key.
This is intended for applications (such as Kibana) that need to
create API keys on behalf of a user using an existing API key credential,
since derived API keys (API keys created by API keys) are not otherwise supported.

## Required authorization

- Cluster privileges: `clone_api_key`

## Authentication

- Api key: `Authorization: <value>`
  Elasticsearch APIs support key-based authentication.
  You must create an API key and use the encoded value in the request header.
  For example:
  
  
  ```
  curl -X GET "${ES_URL}/_cat/indices?v=true" \
    -H "Authorization: ApiKey ${API_KEY}"
  ```
  
  To get API keys, use the `/_security/api_key` APIs.
- Basic: `Authorization: Basic <credentials>`
- Bearer: `Authorization: Bearer <token>`
  Elasticsearch APIs support the use of bearer tokens in the `Authorization` HTTP header to authenticate with the API.
  For examples, refer to [Token-based authentication services](https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/token-based-authentication-services)

## Query string parameters

- `refresh` (enum) — optional
  If `true` (the default) then refresh the affected shards to make this operation visible to search, if `wait_for` then wait for a refresh to make this operation visible to search, if `false` then do nothing with refreshes.
  Values: `true`, `false`, `wait_for`

## Request body

`application/json`

- `api_key` (string) — required
  The credentials of the API key to clone.
This is the secret value returned when the key was originally created.
- `name` (string) — optional
  A name for the cloned API key.
If not provided, the name of the source key is used.
- `expiration` (string) — optional
  The expiration time for the cloned API key.
By default, API keys never expire.
Set to `null` to explicitly create a key with no expiration.
- `metadata` (object) — optional
  Arbitrary metadata to associate with the cloned API key.
It supports nested data structure.
Within the metadata object, keys beginning with `_` are reserved for system usage.

## Response

`application/json`

- `api_key` (string)
  The generated API key value for the cloned key.
- `expiration` (number)
  Expiration in milliseconds for the API key.
- `id` (string)
  The unique ID of the cloned API key.
- `name` (string)
  The name of the cloned API key.
- `encoded` (string)
  API key credentials which is the base64-encoding of
the UTF-8 representation of `id` and `api_key` joined
by a colon (`:`).
## Code examples

#### Console

```console
PUT /_security/api_key/clone
{
  "api_key": "string"
}
```

#### curl

```curl
curl -X PUT "${ELASTICSEARCH_URL}/_security/api_key/clone" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "string"
  }'
```