# HTTP Notification - API KEY **URL:** \ **Category:** Graylog Central (peer support)\ **Created:** [February 15, 2023, 2:37pm UTC](https://community.graylog.org/t/http-notification-api-key/27730 "2023-02-15T14:37:52Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![dieguinsss](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dieguinsss/32/12520_2.png) [@dieguinsss](https://community.graylog.org/u/dieguinsss)\ **Post date:** [February 15, 2023, 2:37pm UTC](https://community.graylog.org/t/http-notification-api-key/27730/1 "2023-02-15T14:37:52Z")
Before you post: Your responses to these questions will help the community help you. Please complete this template if you’re asking a support question. **Don’t forget to select tags to help index your topic!** **1. Describe your incident:** Hello, We are working with Graylog5 and I’d like to setting up Alerts with HTTP Notification linked to our API in AWS. It works fine without API KEY but when I configure it (api key) in Graylog Notification, it response _**" Error: Expected successful HTTP response [2xx] but got [403]."**_. I don’t know if it need a specific name for “api key”… I tested the API with postman and curl from instance where the graylog server is and it worked fine. **2. Describe your environment:** - OS Information: - Graylog 5 - Ubuntu - AWS ---
**Author:** ![gsmith](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gsmith/32/1222_2.png) [@gsmith](https://community.graylog.org/u/gsmith)\ **Post date:** [February 15, 2023, 10:20pm UTC](https://community.graylog.org/t/http-notification-api-key/27730/2 "2023-02-15T22:20:43Z")
Hello , Can you show you configurations? Just checking, Looks like both of these need to be set. > If an API secret is set, an API key must also be set. > And > If an API key is set, an API secret must also be set. ---
**Author:** ![dieguinsss](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dieguinsss/32/12520_2.png) [@dieguinsss](https://community.graylog.org/u/dieguinsss)\ **Post date:** [February 16, 2023, 12:29pm UTC](https://community.graylog.org/t/http-notification-api-key/27730/3 "2023-02-16T12:29:42Z")
Hi @gsmith, Yes, you can. I attached a screenshot below. ![image](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/2X/b/bd785b9820522044784472af5630f2d2fbf58e62.png) ---
**Author:** ![patrickmann](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/patrickmann/32/9091_2.png) [@patrickmann](https://community.graylog.org/u/patrickmann)\ **Post date:** [February 16, 2023, 12:54pm UTC](https://community.graylog.org/t/http-notification-api-key/27730/4 "2023-02-16T12:54:32Z")
HTTP Notification sends the API key as a query parameter. I think AWS is expecting it as a header. I filed an issue for this: [HTTP Notification: support API key as header (in addition to query string) · Issue #14691 · Graylog2/graylog2-server · GitHub](https://github.com/Graylog2/graylog2-server/issues/14691) ---
**Author:** ![dieguinsss](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dieguinsss/32/12520_2.png) [@dieguinsss](https://community.graylog.org/u/dieguinsss)\ **Post date:** [February 16, 2023, 9:37pm UTC](https://community.graylog.org/t/http-notification-api-key/27730/5 "2023-02-16T21:37:47Z")
Hi Patrick, But It does not make sense that Graylog send api-keys as query parameter… That is not secure… ---
**Author:** ![patrickmann](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/patrickmann/32/9091_2.png) [@patrickmann](https://community.graylog.org/u/patrickmann)\ **Post date:** [February 17, 2023, 3:45am UTC](https://community.graylog.org/t/http-notification-api-key/27730/6 "2023-02-17T03:45:12Z")
Only via https Gesendet von [Outlook für Android](https://aka.ms/AAb9ysg) ---
**Author:** ![dieguinsss](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/dieguinsss/32/12520_2.png) [@dieguinsss](https://community.graylog.org/u/dieguinsss)\ **Post date:** [February 17, 2023, 12:20pm UTC](https://community.graylog.org/t/http-notification-api-key/27730/7 "2023-02-17T12:20:25Z")
I don’t know what you mean in your last comment… ---
**Author:** ![patrickmann](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/patrickmann/32/9091_2.png) [@patrickmann](https://community.graylog.org/u/patrickmann)\ **Post date:** [February 17, 2023, 1:13pm UTC](https://community.graylog.org/t/http-notification-api-key/27730/8 "2023-02-17T13:13:55Z")
You are right, security of API-keys is a bit more involved. When sending via SSL, the query string is also encrypted. In that sense it isn’t any less secure than putting the key in a header. But URLs may get logged or passed as referrer headers, exposing the key. Headers are better in that regard. API-Keys shouldn’t be used for authentication anyway. Here is a pretty good discussion: [https://cloud.google.com/docs/authentication/api-keys](https://cloud.google.com/docs/authentication/api-keys) Google cloud APIs accept API keys both in the query string and as a header parameter. Unfortunately, AWS only supports header parameter. ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [March 3, 2023, 1:13pm UTC](https://community.graylog.org/t/http-notification-api-key/27730/9 "2023-03-03T13:13:59Z")
Closed on March 3, 2023, 1:13pm UTC This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.