Create a service account token

POST also PUT /_security/service/{namespace}/{service}/credential/token/{name}
POST /_security/service/{namespace}/{service}/credential/token

Create a service accounts token for access without requiring basic authentication.

Note

Service account tokens never expire. You must actively delete them if they are no longer needed.

Important

On Serverless, non-operator users can create tokens for only elastic/fleet-server and elastic/fleet-server-remote. Creating tokens for any other service account requires operator privileges.

More about service accounts

Required authorization

Authentication

Api key

Authorization: <value>

Elasticsearch APIs support key-based authentication. You must create an API key and use the encoded value in the request header. For example:

		curl -X GET "${ES_URL}/_cat/indices?v=true" \
  -H "Authorization: ApiKey ${API_KEY}"

To get API keys, use the /_security/api_key APIs.

Basic

Authorization: Basic <credentials>

Bearer

Authorization: Bearer <token>

Elasticsearch APIs support the use of bearer tokens in the Authorization HTTP header to authenticate with the API. For examples, refer to Token-based authentication services

Path parameters

Query parameters

Response

application/json

Examples

Request Console 1 / 8 languages

Console Kibana Dev Tools

POST /_security/service/elastic/fleet-server/credential/token/token1

JavaScript Elasticsearch JavaScript Client

const response = await client.security.createServiceToken({
  namespace: "elastic",
  service: "fleet-server",
  name: "token1",
});

Python Elasticsearch Python Client

resp = client.security.create_service_token(
    namespace="elastic",
    service="fleet-server",
    name="token1",
)

curl Shell

curl -X POST "$ELASTICSEARCH_URL/_security/service/elastic/fleet-server/credential/token/token1" \
  -H "Authorization: ApiKey $ELASTIC_API_KEY"

Java Elasticsearch Java Client

client.security().createServiceToken(c -> c
    .name("token1")
    .namespace("elastic")
    .service("fleet-server")
);

C# Elasticsearch .NET Client

var response = await client.Security
    .CreateServiceTokenAsync(new CreateServiceTokenRequest()
    {
        Name = "token1",
        Namespace = "elastic",
        Service = "fleet-server"
    });

PHP Elasticsearch PHP Client

$resp = $client->security()->createServiceToken([
    "namespace" => "elastic",
    "service" => "fleet-server",
    "name" => "token1",
]);

Ruby Elasticsearch Ruby Client

response = client.security.create_service_token(
  namespace: "elastic",
  service: "fleet-server",
  name: "token1"
)

Response

A successful response from POST /_security/service/elastic/fleet-server/credential/token/token1. The response includes the service account token, its name, and its secret value as a bearer token.

{
  "created": true,
  "token": {
    "name": "token1",
    "value": "AAEAAWVsYXN0aWM...vZmxlZXQtc2VydmVyL3Rva2VuMTo3TFdaSDZ" 
  }
}