--- title: Elastic Cloud API keys description: Elastic Cloud API keys allow you to programmatically access the following resources: Elastic Cloud APIs, Elastic Cloud Serverless APIs, Elastic Cloud... url: https://www.elastic.co/elastic/docs-builder/docs/4572/deploy-manage/api-keys/elastic-cloud-api-keys products: - Elastic Cloud Hosted - Elastic Documentation applies_to: - Elastic Cloud Serverless: Generally available - Elastic Cloud Hosted: Generally available --- # Elastic Cloud API keys Elastic Cloud API keys allow you to programmatically access the following resources: - [Elastic Cloud](https://www.elastic.co/docs/api/doc/cloud/) APIs - [Elastic Cloud Serverless](https://www.elastic.co/docs/api/doc/elastic-cloud-serverless/) APIs - [Elastic Cloud Billing](https://www.elastic.co/docs/api/doc/cloud-billing/) APIs - Elastic Cloud Serverless: Generally available Optionally, [Elasticsearch Elastic Cloud Serverless](https://www.elastic.co/docs/api/doc/elasticsearch-serverless/) and [Kibana Elastic Cloud Serverless](https://www.elastic.co/docs/api/doc/serverless/) APIs By default, Elastic Cloud API keys provide access to the APIs for managing your organization, deployments, and projects.Elastic Cloud Hosted: Generally available In Elastic Cloud Hosted deployments, Elastic Cloud API keys do not provide access to Elasticsearch or Kibana APIs. [Learn how to create an Elasticsearch API key for ECH deployments](https://www.elastic.co/elastic/docs-builder/docs/4572/deploy-manage/api-keys/elasticsearch-api-keys).Elastic Cloud Serverless: Generally available For Elastic Cloud Serverless projects, you can optionally grant access to Elasticsearch and Kibana APIs when you [assign roles to the API key](#project-access). An Elastic Cloud API key belongs to the organization and is not tied to the user who created it. When a key is created, it is assigned specific roles that control its access to organizational resources. If the creator leaves the organization, the API keys they created will still function until they expire or are revoked. You can have multiple API keys for different purposes, and you can revoke them when you no longer need them. Each organization can have up to 500 active API keys. A skill is available to help AI agents with this topic. ## Required permissions To create and manage Elastic Cloud API keys, you must be one of the following: - An **Organization owner**: Can create API keys for the organization, and can view and revoke all API keys in the organization. - A user who can [**manage workload credentials**](/elastic/docs-builder/docs/4572/deploy-manage/users-roles/cloud-organization/user-roles#manage-workload-credentials): Can create API keys, and can list and revoke only the API keys they created. For more information, refer to [User roles and privileges](/elastic/docs-builder/docs/4572/deploy-manage/users-roles/cloud-organization/user-roles#ec_organization_level_roles). ## Create an API key 1. Log in to the [Elastic Cloud Console](https://cloud.elastic.co?page=docs&placement=docs-body). 2. From the navigation menu, select **Organization** > **API keys**. 3. Click **Create API key**. 4. On the **Create API key** flyout, you can configure your new key: 1. Add a unique name for the key. 2. Set the [expiration](#expiration) for the key. 3. Assign [roles](#roles). You can also allow the key to [manage workload credentials](/elastic/docs-builder/docs/4572/deploy-manage/users-roles/cloud-organization/user-roles#manage-workload-credentials). 5. Click **Create API key**, copy the generated API key, and store it in a safe place. You can also download the key as a CSV file. The API key needs to be supplied in the `Authorization` header of a request, in the following format: ```sh Authorization: ApiKey $EC_API_KEY ``` You can create an API key using the [Create API key](https://www.elastic.co/docs/api/doc/cloud//operation/operation-create-api-key) API. ```sh curl -XPOST \ -H 'Content-Type: application/json' \ -H "Authorization: ApiKey $EC_API_KEY" \ "https://api.elastic-cloud.com/api/v1/users/auth/keys { "description": "api-created-key", "expiration": "90d", "role_assignments": { "project": { "elasticsearch": [ { "role_id": "elasticsearch-admin", "organization_id": "ORG_ID_PLACEHOLDER", "all": false, "project_ids": [ "PROJECT_ID_PLACEHOLDER" ], "application_roles": [ "admin" ] } ] } } } ``` ## Revoke an API key 1. Log in to [Elastic Cloud](https://cloud.elastic.co?page=docs&placement=docs-body). 2. From the navigation menu, select **Organization** > **API keys**. 3. Find the key you want to revoke, and click the trash icon under **Actions**. ## API key expiration By default, API keys expire after three months. You can set the expiration to a different preset value or to a specific date, up to one year. If you need the key to work indefinitely, you can set its expiration to **Never**. When an API key is nearing expiration, Elastic sends an email to the creator of the API key and each of the operational contacts. When you use an API key to authenticate, the API response header `X-Elastic-Api-Key-Expiration` indicates the key’s expiration date. You can log this value to detect API keys that are nearing expiration. When an API key expires, it is automatically removed from the **API keys** page. ## Applying roles to API keys Roles grant an API key specific privileges for your Elastic Cloud organization and resources. You can grant a cloud API key [the same types of roles that you assign to users](/elastic/docs-builder/docs/4572/deploy-manage/users-roles/cloud-organization/user-roles#types-of-roles): organization-level roles, cloud resource access roles, and connected cluster access roles. The roles you can assign depend on your privileges: - **Organization owners** can assign any roles. - Users who can **manage workload credentials** can assign only roles they already hold, on deployments or projects they already have access to. ### Granting Elasticsearch and Kibana API access - Elastic Cloud Serverless: Generally available When you grant **Organization owner** access, or **Cloud resource** access for one or more Serverless projects, you can select your level of API access: | Access | Grant | |------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Cloud API** (default) | Grants access to only [Elastic Cloud](https://www.elastic.co/docs/api/doc/cloud/) and [Elastic Cloud Serverless](https://www.elastic.co/docs/api/doc/elastic-cloud-serverless/) APIs. No direct access to project Elasticsearch or Kibana API endpoints. | | **Cloud, Elasticsearch, and Kibana API** | Grants the following access:• [Elastic Cloud](https://www.elastic.co/docs/api/doc/cloud/) and [Elastic Cloud Serverless](https://www.elastic.co/docs/api/doc/elastic-cloud-serverless/) APIs• [Elasticsearch Serverless](https://www.elastic.co/docs/api/doc/elasticsearch-serverless/), and [Kibana Serverless](https://www.elastic.co/docs/api/doc/serverless/) API endpoints for the relevant projects | | **Elasticsearch and Kibana API** | Grants access to [Elasticsearch Serverless](https://www.elastic.co/docs/api/doc/elasticsearch-serverless/) and [Kibana Serverless](https://www.elastic.co/docs/api/doc/serverless/) API endpoints for the relevant projects, with limited access to [Elastic Cloud](https://www.elastic.co/docs/api/doc/cloud/) APIs | Using Elastic Cloud keys for project-level API access, rather than [granting keys from within each Serverless project](https://www.elastic.co/elastic/docs-builder/docs/4572/deploy-manage/api-keys/serverless-project-api-keys), allows you to create keys that can interact with multiple projects, and manage API access centrally from the Elastic Cloud console. To use a key with a project's Elasticsearch API, pair it with the project's endpoint. Refer to [Find your Serverless project connection details](https://www.elastic.co/elastic/docs-builder/docs/4572/deploy-manage/deploy/elastic-cloud/find-connection-details-serverless). The [cross-project search feature](/elastic/docs-builder/docs/4572/deploy-manage/cross-project-search-config/cps-config-access-and-scope#manage-user-and-api-key-access) requires Elastic Cloud API keys for programmatic access. When granting Cloud resource access, you can apply a [predefined role](/elastic/docs-builder/docs/4572/deploy-manage/users-roles/cloud-organization/user-roles#general-assign-user-roles-table) or [custom role](https://www.elastic.co/elastic/docs-builder/docs/4572/deploy-manage/users-roles/serverless-custom-roles) to granularly control access to the specified resources. The selected role controls access to resources in all relevant APIs. #### Restrict access to Elastic Cloud APIs To limit an API key to project-level operations without granting access to organization-level Elastic Cloud APIs, set the API access level to **Elasticsearch and Kibana API** on every role assignment for the key. This is useful when you need programmatic access to project data without exposing organization management capabilities. API access is additive. If any role assignment on the key uses **Cloud API** or **Cloud, Elasticsearch, and Kibana API** access, the key has access to the Elastic Cloud API, as defined by the role, regardless of what is set on other assignments. #### Considerations The **API access** selection impacts the behavior of the selected role. Most roles require an access level that includes Elasticsearch and Kibana API access, either **Cloud, Elasticsearch, and Kibana API** or **Elasticsearch and Kibana API**, to take full effect. When Elasticsearch and Kibana API access is not granted, roles that are designed to work inside of the project have limited access. For example: - Roles such as the Security **Tier 1 analyst** role have only **Viewer** access to the relevant projects through Elastic Cloud APIs. - [Custom roles](https://www.elastic.co/elastic/docs-builder/docs/4572/deploy-manage/users-roles/serverless-custom-roles) are also limited to **Viewer** access in the project. When access is set to **Elasticsearch and Kibana API**, the API key can use the role's permissions in the project, but cannot access organization-level Elastic Cloud APIs such as members, billing, or network security. For details on the permissions granted for each role, refer to the [predefined roles table](/elastic/docs-builder/docs/4572/deploy-manage/users-roles/cloud-organization/user-roles#general-assign-user-roles-table).