How to set up "Connecting without an API key" when automating Seq setup?

[mloskot]

(I have searched "password change is required" and found two discussion threads, #1593 and #2326, related but not answering my case.)

I've deployed Seq to AKS cluster using the Helm chart version 2025.1.1 (latest release):

values:
  extraEnvs:
  - name: SEQ_FIRSTRUN_ADMINPASSWORD # TODO: Switch to firstRunAdminPassword as soon as chart 2025.2 is released
    value: My@Password123
  image:
    pullPolicy: IfNotPresent
    repository: datalust/seq
    tag: "2025"
  nodeSelector:
    kubernetes.io/os: linux
  persistence:
    enabled: true
    size: 16Gi  # Double the default,/minimum https://github.com/datalust/helm.datalust.co/blob/21016831b9934b028a61ea3128f154e939b8c549/charts/seq/values.yaml#L174
    storageClass: managed-csi

Without heading to the Seq UI, I immediately started the procedure for Connecting without an API key in order, as it promises, to:

Use initial username and password of administrator account to create an API key (...).
You can use these to create an API key, and then use the API key token with the remaining seqcli commands.

with aim to use seqcli only, no UI, to create API keys for my apps that I'm going to set up to log to Seq.

So, I copied the PowerShell script and re-worked it into Bash script seq-create-apikey-admin.sh:

#!/bin/bash
SEQ_SERVER_URL=https://seq.example.com
SEQ_ADMIN_USER="admin"
SEQ_ADMIN_PASS="My@Password123"

echo $SEQ_ADMIN_PASS |
seqcli apikey create \
  -t CLI \
  --permissions="read,write,project,organization,system" \
  --connect-username $SEQ_ADMIN_USER --connect-password-stdin \
  --server $SEQ_SERVER_URL

This is what I get when I run the script:

I'm confused, because this answer #1593 (comment) says

when firstRun.adminUsername and firstRun.adminPasswordHash are specified, no password change should be required by default.

which, given date of that answer, I take as firstRunAdminPassword / SEQ_FIRSTRUN_ADMINPASSWORD are meant to be included as well.

However, the answer says also this:

You'll only be able to use the "firstRun" settings before Seq has ever started up

which confuses me even more. When that "before Seq has ever started up" is meant to happen during the sequence of deployment to Kubernetes?

Getting back to the main issue, could anyone help me understand what am I doing wrong for Connecting without an API key or how to do script the following, without going via Seq UI?

1. Deploy Seq

2. Use Seq API (e.g. sqlcli) to get API key for administration purposes (i.e. seq-create-apikey-admin.sh)

3. Use Seq API (e.g. sqlcli) to get API keys for ingestion purposes (i.e. seq-create-apikey-app.sh) like so

   #!/bin/bash
   SEQ_ADMIN_APIKEY=... # created with seq-create-apikey-admin.sh
   SEQ_SERVER_URL=https://seq.example.com
   
   seqcli apikey create \
     --server="${SEQ_SERVER_URL}" \
     --apikey="${SEQ_ADMIN_APIKEY}" \
     --title="frontend-123" \
     --permissions=Ingest \
     --property="env=dev" \
     --property="app=frontend-123"

That is, as said in datalust/seqcli#188 (comment), to:

create the initial token for further usage in other infra code

[nblumhardt]

Hi @mloskot!

If you use plain-text SEQ_FIRSTRUN_ADMINPASSWORD, a password change is required. You won't be able to use the password immediately with apikey create in this case.

If you use the more secure SEQ_FIRSTRUN_ADMINPASSWORDHASH option instead, no password change is necessary, and apikey create with username and password should just work.

It sounds like this might have caused some subsequent confusion - does this clarify it?

[mloskot]

Hi @nblumhardt,
That was exactly it!

I have re-deployed my Seq instance fresh with SEQ_FIRSTRUN_ADMINPASSWORDHASH, then my script creating API keys for logs ingestion from my apps worked well. And, the additional thing I had to tweak was:

- --permissions="read,write,project,organization,system" 
+ --permissions="ingest,read,write,project,organization,system" 

which is related to what I learned in #2452, see also

• docs: Clarify permissions for connecting without the API key #2455

Thank you!

[nblumhardt]

That's great - thanks for closing the loop! 👍