## Elasticsearch Serverless integration

Elastic Cloud Serverless is a fully managed, autoscaling Elasticsearch offering that removes the need to size nodes, shards, or clusters. The Elasticsearch Serverless integration with Frontegg allows your application to search, index, and manage documents, indices, ingest pipelines, scripts, and security objects in a Serverless project on behalf of your users.

Prerequisites
- An [Elastic Cloud](https://cloud.elastic.co) account with access to create Serverless projects
- Organization-level permission to manage projects and API keys
- The full project endpoint URL, including scheme and port (for example, `https://my-project-cd40d6.es.us-central1.gcp.elastic.cloud:443`)


API keys only
Elasticsearch Serverless authenticates with **API keys only** — native realm users and password-based (Basic) authentication are not supported. The Frontegg connector sends every request with an `Authorization: ApiKey <encoded-key>` header; pasting a Basic token will not work.

### Create an Elasticsearch Serverless project

#### Step 1: Open the Serverless projects page in Elastic Cloud

Go to [cloud.elastic.co](https://cloud.elastic.co) and sign in. In the left navigation, click **Serverless**. If you have no projects yet, click **Create serverless project**. On the **Which type of project would you like to create?** step, pick **Elasticsearch** and click **Next step**.

![Serverless project type selection with Elasticsearch highlighted](/assets/elasticsearch-serverless-1.196e0a88375a163599d642e59046aacb39e05d5c93435972a31545539bb17fb1.1ce25488.png)

#### Step 2: Confirm project settings

On the **Confirm your project settings** step:

- **Name**: enter `Frontegg Integration` (or any descriptive name)
- **Cloud provider**: pick the provider closest to your users (AWS, GCP, or Azure)
- **Region**: pick the region that matches your data-residency requirements


Click **Create serverless project**. Provisioning usually takes 1–2 minutes.

![Project settings form with name, cloud provider, and region](/assets/elasticsearch-serverless-2.41c75f48926abe9430a0fdf3e935c095d77c3026613246eb6758dfa3763e6a46.1ce25488.png)

#### Step 3: Open the project and copy the Elasticsearch endpoint

When the project is ready, click **Open project**. You land on the Kibana **Getting started** page, which displays the project's **Elasticsearch endpoint**. Copy that URL — this is the value you will paste into the Frontegg **Serverless project endpoint URL** field.

![Kibana Getting started page with Elasticsearch endpoint for the Serverless project](/assets/elasticsearch-serverless-3.5875769c5614ad2e20c29785166a2d4358e7af5e99d2953eb87219ab403973cd.1ce25488.png)

You can also find the endpoint in the Elastic Cloud admin console, on the project overview page under **Application endpoints, cluster and component IDs** → **Open Elasticsearch**.

![Elastic Cloud project overview showing the Elasticsearch public endpoint](/assets/elasticsearch-serverless-4.1170d3c24a7f48a90f54d652c3dc2414320bc98fafea667a629fe4685f40acc9.1ce25488.png)

### Create an API key

#### Step 1: Open API keys in the project

In the Kibana side navigation, open **Admin and settings** → **Access** → **API keys**. You land on the API keys list for your account. Click **Create API key** in the top-right corner.

![Serverless project API keys page with Create API key button highlighted](/assets/elasticsearch-serverless-5.1f766203d52f240878d58fc136e68cf8a5f7665ed4a44c44949af7deabf705fe.1ce25488.png)

#### Step 2: Configure the key

In the **Create API key** dialog:

- **Name**: `Frontegg Integration`
- **Type**: leave as **Personal**
- **Apply expiration date**: leave off for non-expiring keys, or set an expiration if required by your security policy
- **Control security privileges**: leave off to inherit your account's privileges, or enable it to restrict the key to specific indices and APIs


Click **Create API key**.

Which privileges does the connector need?
The Serverless connector exposes search, documents, a subset of indices and `cat` endpoints, templates, ingest, scripts, analysis, security, and SQL APIs. Grant the key read/write access to every index your agents will touch. Cluster-level, node-level, snapshot, and tasks APIs are not available on Serverless.

![Create API key dialog with Name field filled in](/assets/elasticsearch-serverless-6.33de959d66116689fddad8705da46a07d1ba36c2800fa9637493a4fbd8f97c43.1ce25488.png)

#### Step 3: Copy the encoded key

After clicking **Create API key**, Kibana displays the generated key **once**. Switch the output format selector to **Encoded** and click the copy icon. The encoded key is a single base64 string of the form `<id>:<api_key>` — paste this value into the Frontegg **API Key** field.

Copy the API key now
Kibana does not let you view the encoded value again after closing the dialog. If you lose it, create a new API key and delete the old one from the API keys list.

![API key created dialog with the encoded key shown once and the copy button highlighted](/assets/elasticsearch-serverless-7.55bd07876af45641cd19d853f46f31752df816446bcd74f04e63a3b950e29c8c.1ce25488.png)

### Configure the Frontegg portal

Once you have the encoded API key from the steps above, enter it in the integration configuration page of the Frontegg portal:

1. Open the **Frontegg portal** and navigate to [ENVIRONMENT] → Integrations → Elasticsearch Serverless.
2. Paste the encoded **API Key** into the **API Key** field.
3. Paste your project endpoint URL, including scheme and port, into the **Serverless project endpoint URL** field.
4. Click **Save**.


Keep your credentials secure
Never share or commit your API key to version control. Rotate the credential from the project's API keys page if you suspect it has been leaked.

### Provider limitations

Elasticsearch Serverless does not expose the full self-managed API surface. The connector preserves the shape of the API, but the following operation groups are unavailable on Serverless and will return an error at execution time:

| Operation group | Notes |
|  --- | --- |
| Cluster APIs | Cluster-level state, settings, and health are managed by Elastic. |
| Node APIs | Nodes are not exposed to the user. |
| Snapshot APIs | Snapshots are handled automatically by Elastic. |
| Tasks APIs | Task management is not available to users. |
| `_open` / `_close` on indices | Not supported on Serverless. |
| `cat` APIs for nodes, shards, health | Only `catIndices`, `catAliases`, and `catCount` are exposed. |


### Additional resources

- [Elastic Cloud Serverless documentation](https://www.elastic.co/docs/deploy-manage/deploy/elastic-cloud/serverless)
- [Elasticsearch API keys reference](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/api-keys)
- [Differences between Serverless and self-managed Elasticsearch](https://www.elastic.co/docs/deploy-manage/deploy/elastic-cloud/differences-from-other-elasticsearch-offerings)
- [Elastic Cloud console](https://cloud.elastic.co)