# Creating an APIkey when declaratively creating a KongCredential

**URL:** <https://discuss.konghq.com/t/creating-an-apikey-when-declaratively-creating-a-kongcredential/4163>\
**Category:** General\
**Created:** [August 5, 2019, 7:27pm UTC](https://discuss.konghq.com/t/creating-an-apikey-when-declaratively-creating-a-kongcredential/4163 "2019-08-05T19:27:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bosterito95](https://avatars.discourse-cdn.com/v4/letter/b/ccd318/32.png) [@Bosterito95](https://discuss.konghq.com/u/Bosterito95)\
**Post date:** [August 5, 2019, 7:27pm UTC](https://discuss.konghq.com/t/creating-an-apikey-when-declaratively-creating-a-kongcredential/4163/1 "2019-08-05T19:27:43Z")

</div>

Hello,

I am trying to declaratively create a KongConsumer and accompanying KongCredential based on the documentation here: [https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/references/custom-resources.md](https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/references/custom-resources.md)

It works fine, but I would like Kong to create the apikey for me in config of KongCredential (instead of me typing in a random password). Is there a best way to do this?

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [August 5, 2019, 7:37pm UTC](https://discuss.konghq.com/t/creating-an-apikey-when-declaratively-creating-a-kongcredential/4163/2 "2019-08-05T19:37:07Z")

</div>

Please have a look at the example:

> <https://github.com/Kong/kubernetes-ingress-controller/blob/master/docs/references/custom-resources.md#kongcredential>

You can define your API key using the `key` parameter.

---

<div class="post-metadata">

**Author:** ![Bosterito95](https://avatars.discourse-cdn.com/v4/letter/b/ccd318/32.png) [@Bosterito95](https://discuss.konghq.com/u/Bosterito95)\
**Post date:** [August 5, 2019, 9:02pm UTC](https://discuss.konghq.com/t/creating-an-apikey-when-declaratively-creating-a-kongcredential/4163/3 "2019-08-05T21:02:42Z")

</div>

@hbagdi thanks for the quick response. Yup - is there a way to make this a secret/ hashed? It seems like a security risk to be able to just create keys when something like this is doable:

> [@Scoping of KongCredentials](https://discuss.konghq.com/t/scoping-of-kongcredentials/3160/2):
>
> Hello @jmtoball, Thank you for the detailed explanation. Is this expected? Is this a bug? Is there a better way to do this, apart from creating a namespace per endpoint? This is not a bug but an expected behavior. The Ingress Controller doesn’t enforce any k8s namespace level scopes in Kong. Any consumer with valid credential will be authenticated by Kong, no matter which namespace it belongs to. There are a couple of ways to solve this problem: Run an Ingress Controller in each namesp…

---

<div class="post-metadata">

**Author:** ![hbagdi](https://yyz2.discourse-cdn.com/flex036/user_avatar/discuss.konghq.com/hbagdi/32/562_2.png) [@hbagdi](https://discuss.konghq.com/u/hbagdi)\
**Post date:** [August 5, 2019, 9:59pm UTC](https://discuss.konghq.com/t/creating-an-apikey-when-declaratively-creating-a-kongcredential/4163/4 "2019-08-05T21:59:05Z")

</div>

@Bosterito95

I totally get your fear but there is no way to do this as of now using a secret.  
This is something that we are aware is very important to address and we have this as a high priority item on the roadmap.