---
title: Authenticate to the Kibana API with a service account
description: Create a service token and use a user-managed service account to authenticate to Kibana APIs.
url: https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8921/deploy-manage/users-roles/cluster-or-deployment-auth/authenticate-kibana-api-with-service-account
products:
  - Elastic Cloud Enterprise
  - Elastic Cloud Hosted
  - Elastic Cloud on Kubernetes
  - Elastic Documentation
  - Elastic Stack
  - Elasticsearch
  - Kibana
applies_to:
  - Elastic Cloud Serverless: Unavailable
  - Elastic Stack: Planned
---

# Authenticate to the Kibana API with a service account
Use a service token to authenticate programmatic requests to Kibana as a user-managed service account. The account provides a non-human identity whose privileges come from its assigned roles.
On Elastic Cloud Serverless, use [API keys](https://docs-v3-preview.elastic.dev/elastic/docs-content/pull/8921/deploy-manage/api-keys) for programmatic access from external applications, because service account tokens aren't available for this use.

## Before you begin

Before you create a service token, make sure you have the following:
- You need an existing user-managed service account. If you don't have one, [create a service account in Kibana](/elastic/docs-content/pull/8921/deploy-manage/users-roles/cluster-or-deployment-auth/manage-service-accounts-in-kibana#create-service-account-kibana).
- You need the `manage_security` cluster privilege to create a service token for a user-managed account. The `manage_service_account` privilege permits token management only for built-in accounts in the `elastic` namespace.


## Create a service token for your application

Kibana creates and stores a credential when you create an account in the UI. That credential is used for workload integrations and isn't displayed. For your application, create an additional service token. The following example uses an existing account with the principal `kibana/automation-client`:
1. Use the [create service account token API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-create-service-token) to create a token for the account:
   ```json
   ```
2. Copy the `token.value` from the response and store it securely, such as in a secrets manager. Service tokens don't expire, and you can't retrieve this value again.


## Call a Kibana API

To call the Kibana API using the service account identity, send the token with the `Bearer` authentication scheme:
```shell
curl --request GET "$KIBANA_URL/api/spaces/space" \
  --header "Authorization: Bearer $SERVICE_ACCOUNT_TOKEN"
```

Ensure that your [HTTP authentication configuration](/elastic/docs-content/pull/8921/deploy-manage/users-roles/cluster-or-deployment-auth/kibana-authentication#http-authentication) accepts the `Bearer` scheme.
The response depends on the account's roles. A `403` response means the account authenticated but doesn't have the required privilege. Add privileges by editing the assigned role rather than assigning broad administrative roles to the account.
For requests that change data, also include the headers required by that API, such as `kbn-xsrf`.

## Call an Elasticsearch API

You can use the same token to authenticate to Elasticsearch. For example, verify the account's identity with the authenticate API:
```shell
curl --request GET "$ELASTICSEARCH_URL/_security/_authenticate" \
  --header "Authorization: Bearer $SERVICE_ACCOUNT_TOKEN"
```


## Remove access

Service tokens don't expire. When an application no longer needs access, use the [delete service account token API](https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-security-delete-service-token) to delete only its token:
```json
```

Deleting the token stops requests that use it without affecting the account or its other service tokens.
To prevent new authentications with any of the account's service tokens, [deactivate the account](/elastic/docs-content/pull/8921/deploy-manage/users-roles/cluster-or-deployment-auth/manage-service-accounts-in-kibana#disable-service-account). To permanently remove the identity and its associated credentials, [delete the account in Kibana](/elastic/docs-content/pull/8921/deploy-manage/users-roles/cluster-or-deployment-auth/manage-service-accounts-in-kibana#delete-service-account-kibana).