Skip to main content
This option is for clusters or providers that authenticate with the Authorization: ApiKey <key> HTTP scheme — historically Elasticsearch’s format, adopted by some hosted OpenSearch providers. Stock OpenSearch (Apache 2.0) does not have a native API-key feature in its Security Plugin; if your cluster is a self-hosted or unmodified OpenSearch cluster, use the Basic Authentication or JWT Bearer Token option instead. The cluster must serve a TLS certificate signed by a Certificate Authority (public or internal) that the calling environment trusts.

​
Confirm your cluster supports the ApiKey scheme

The connector sends Authorization: ApiKey <key> on every request. Only pick this auth mode if your cluster or provider explicitly documents this scheme.

1

Verify what your provider supports

Common cases:

  • Elasticsearch-compatible clusters — Elasticsearch has a native API-key feature (POST /_security/api_key) that accepts the Authorization: ApiKey <base64(id:api_key)> scheme. OpenSearch clusters running on top of Elasticsearch 7.10 (pre-fork) may still accept it.
  • Hosted providers — some managed OpenSearch offerings (for example, Alibaba Cloud’s OpenSearch LLM-Based Conversational Search Edition) issue provider-scoped API keys accepted on the same header. Consult your provider’s docs to confirm.
  • Stock OpenSearch (Apache 2.0) — the Security Plugin does not natively issue API keys. Use Basic Authentication for username+password, or JWT Bearer Token for OpenSearch On-Behalf-Of (OBO) tokens generated at POST /_plugins/_security/api/generateonbehalfoftoken. See Authorization tokens.

​
Copy the endpoint URL

Enter the fully-qualified HTTPS URL of your cluster’s REST API.

1

Copy the URL from your platform

The URL is provided by whichever platform issues the API key.

  • For self-hosted / ES-compatible clusters, the HTTPS URL of the cluster’s REST port (default 9200).
  • For managed providers with API keys, the endpoint URL is shown in the provider’s console next to the key.
  • The URL must use HTTPS — TLS is required.
  • No trailing slash.

​
Generate the API key with your provider

The exact create-key flow varies per provider. Two common patterns:

1

Create a key via the Elasticsearch security API

If your cluster exposes the Elasticsearch security API, issue a key via REST:

  • Send POST /_security/api_key with a JSON body specifying name (e.g. stackone-integration), an optional expiration, and a role_descriptors block scoping the key to the indexes and cluster actions it needs.
  • The response includes id and api_key. Concatenate as {id}:{api_key} and Base64-encode — that Base64 string is the value to paste into the connector.
  • The response is shown ONCE; store it now — the raw key value cannot be retrieved later.
2

Create a key in the provider console

For managed providers with their own key-management UI:

  • Open the provider’s console (for example, Alibaba Cloud OpenSearch), navigate to the instance’s API-key or credentials page, and create a new key.
  • Copy the key exactly as displayed — the value already includes any encoding the provider applies.

​
Verify the credentials

A quick verification catches wrong scheme or wrong role before configuring the connector.

1

Verify with a manual health check

From a shell that can reach the cluster, send GET /_cluster/health with the Authorization: ApiKey <key> header and inspect the response:

  • 200 OK with a JSON status — credentials work.
  • 401 Unauthorized — the key is wrong or the cluster does not accept the ApiKey scheme. Switch to Basic Authentication or JWT.
  • 403 Forbidden — the key authenticates but its role lacks a permission. Widen the key’s role_descriptors or map the underlying user to a broader role.

​
Enter credentials in StackOne Hub

Paste the values below into StackOne Hub to connect the account.

1

Fill in the connection fields

Copy each value from the create-key response or provider console.

  • OpenSearch Endpoint URL — the HTTPS endpoint from step 2.
  • API Key — the Base64-encoded key value. StackOne sends it as-is on the Authorization: ApiKey <value> header — do not add the ApiKey prefix yourself.
  • OpenSearch Dashboards URL — optional. Required only for dashboards_* actions. Leave blank for core datasync workflows.

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • OpenSearch Endpoint URL
  • API Key
  • OpenSearch Dashboards URL (Optional)
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account in your Accounts page.