> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect OpenSearch with API Key – StackOne Hub

> Link a OpenSearch account in the StackOne Hub using API Key. End-user guide to authorize the integration and start using OpenSearch actions.

<Warning>This option is for clusters or providers that authenticate with the `Authorization: ApiKey <key>` HTTP scheme — historically Elasticsearch's format, adopted by some hosted OpenSearch providers. <strong>Stock OpenSearch (Apache 2.0) does not have a native API-key feature in its Security Plugin</strong>; if your cluster is a self-hosted or unmodified OpenSearch cluster, use the <strong>Basic Authentication</strong> or <strong>JWT Bearer Token</strong> option instead. The cluster must serve a TLS certificate signed by a Certificate Authority (public or internal) that the calling environment trusts.</Warning>

<section data-guide-section data-guide-scopes="">
  <h2>Confirm your cluster supports the ApiKey scheme</h2>

  <p>The connector sends `Authorization: ApiKey <key>` on every request. Only pick this auth mode if your cluster or provider explicitly documents this scheme.</p>

  <Steps>
    <Step title="Verify what your provider supports">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Common cases:</p>

        <ul>
          <li><strong>Elasticsearch-compatible clusters</strong> — Elasticsearch has a native API-key feature (`POST /_security/api_key`) that accepts the `Authorization: ApiKey <base64(id:api_key)>` scheme. OpenSearch clusters running on top of Elasticsearch 7.10 (pre-fork) may still accept it.</li>
          <li><strong>Hosted providers</strong> — some managed OpenSearch offerings (for example, Alibaba Cloud's OpenSearch LLM-Based Conversational Search Edition) issue provider-scoped API keys accepted on the same header. Consult your provider's docs to confirm.</li>
          <li><strong>Stock OpenSearch (Apache 2.0)</strong> — the Security Plugin does not natively issue API keys. Use <strong>Basic Authentication</strong> for username+password, or <strong>JWT Bearer Token</strong> for OpenSearch On-Behalf-Of (OBO) tokens generated at `POST /_plugins/_security/api/generateonbehalfoftoken`. See <a href="https://docs.opensearch.org/latest/security/access-control/authentication-tokens/" target="_blank" rel="noopener noreferrer">Authorization tokens</a>.</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Copy the endpoint URL</h2>

  <p>Enter the fully-qualified HTTPS URL of your cluster's REST API.</p>

  <Steps>
    <Step title="Copy the URL from your platform">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>The URL is provided by whichever platform issues the API key.</p>

        <ul>
          <li>For <strong>self-hosted / ES-compatible clusters</strong>, the HTTPS URL of the cluster's REST port (default `9200`).</li>
          <li>For <strong>managed providers with API keys</strong>, the endpoint URL is shown in the provider's console next to the key.</li>
          <li>The URL must use HTTPS — TLS is required.</li>
          <li>No trailing slash.</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Generate the API key with your provider</h2>

  <p>The exact create-key flow varies per provider. Two common patterns:</p>

  <Steps>
    <Step title="Create a key via the Elasticsearch security API">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>If your cluster exposes the Elasticsearch security API, issue a key via REST:</p>

        <ul>
          <li>Send `POST /_security/api_key` with a JSON body specifying `name` (e.g. `stackone-integration`), an optional `expiration`, and a `role_descriptors` block scoping the key to the indexes and cluster actions it needs.</li>
          <li>The response includes `id` and `api_key`. Concatenate as `{id}:{api_key}` and Base64-encode — that Base64 string is the value to paste into the connector.</li>
          <li>The response is shown ONCE; store it now — the raw key value cannot be retrieved later.</li>
        </ul>
      </div>
    </Step>

    <Step title="Create a key in the provider console">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>For managed providers with their own key-management UI:</p>

        <ul>
          <li>Open the provider's console (for example, Alibaba Cloud OpenSearch), navigate to the instance's API-key or credentials page, and create a new key.</li>
          <li>Copy the key exactly as displayed — the value already includes any encoding the provider applies.</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Verify the credentials</h2>

  <p>A quick verification catches wrong scheme or wrong role before configuring the connector.</p>

  <Steps>
    <Step title="Verify with a manual health check">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>From a shell that can reach the cluster, send `GET /_cluster/health` with the `Authorization: ApiKey <key>` header and inspect the response:</p>

        <ul>
          <li><strong>200 OK</strong> with a JSON status — credentials work.</li>
          <li><strong>401 Unauthorized</strong> — the key is wrong or the cluster does not accept the ApiKey scheme. Switch to Basic Authentication or JWT.</li>
          <li><strong>403 Forbidden</strong> — the key authenticates but its role lacks a permission. Widen the key's `role_descriptors` or map the underlying user to a broader role.</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<section data-guide-section data-guide-scopes="">
  <h2>Enter credentials in StackOne Hub</h2>

  <p>Paste the values below into StackOne Hub to connect the account.</p>

  <Steps>
    <Step title="Fill in the connection fields">
      <div data-guide-step data-guide-scopes="" data-guide-display-scopes-list="">
        <p>Copy each value from the create-key response or provider console.</p>

        <ul>
          <li><strong>OpenSearch Endpoint URL</strong> — the HTTPS endpoint from step 2.</li>
          <li><strong>API Key</strong> — the Base64-encoded key value. StackOne sends it as-is on the `Authorization: ApiKey <value>` header — do not add the `ApiKey` prefix yourself.</li>
          <li><strong>OpenSearch Dashboards URL</strong> — optional. Required only for `dashboards_*` actions. Leave blank for core datasync workflows.</li>
        </ul>
      </div>
    </Step>
  </Steps>
</section>

<div data-whitelabel-hide>
  <h2>Linking the Account from the Hub</h2>

  <Steps>
    <Step title="Navigate to the Hub">
      Use one of the three <a href="/connect/managing-connectors/linking-accounts">Linking Account Methods</a> to access the Hub.
    </Step>

    <Step title="Fill out the fields">
      Fill out the following fields using details from your provider:

      <ul>
        <li><strong>OpenSearch Endpoint URL</strong></li>
        <li><strong>API Key</strong></li>
        <li><strong>OpenSearch Dashboards URL</strong> (Optional)</li>
      </ul>
    </Step>

    <Step title="Connect">
      <ul>
        <li>Click <strong>Connect</strong></li>
        <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
        <li>Once authorization is successful, you will see a confirmation popup</li>
      </ul>
    </Step>
  </Steps>

  <p>If the account linking is successful, you will see the newly linked account in your <a href="/gateway/concepts/linked-accounts">Accounts</a> page.</p>
</div>