diff --git a/CHANGELOG.md b/CHANGELOG.md
index 58c69c0c7..c75c53d78 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,6 @@
 ## [Unreleased]
 
+- Add key_id to the `elasticstack_elasticsearch_api_key` resource. ([#789](https://github.com/elastic/terraform-provider-elasticstack/pull/789))
 - Fix handling of `sys_monitoring` in `elasticstack_fleet_agent_policy` ([#792](https://github.com/elastic/terraform-provider-elasticstack/pull/792))
 - Migrate `elasticstack_fleet_agent_policy`, `elasticstack_fleet_integration` (both), and `elasticstack_fleet_server_host` to terraform-plugin-framework ([#785](https://github.com/elastic/terraform-provider-elasticstack/pull/785))
 - Fix for synthetics http/tcp monitor produces inconsistent result after apply ([#801](https://github.com/elastic/terraform-provider-elasticstack/pull/801))
diff --git a/docs/resources/elasticsearch_security_api_key.md b/docs/resources/elasticsearch_security_api_key.md
index 972a3a558..d039758d2 100644
--- a/docs/resources/elasticsearch_security_api_key.md
+++ b/docs/resources/elasticsearch_security_api_key.md
@@ -98,6 +98,7 @@ output "api_key" {
 - `encoded` (String, Sensitive) API key credentials which is the Base64-encoding of the UTF-8 representation of the id and api_key joined by a colon (:).
 - `expiration_timestamp` (Number) Expiration time in milliseconds for the API key. By default, API keys never expire.
 - `id` (String) Internal identifier of the resource.
+- `key_id` (String) Unique id for this API key.
 
 <a id="nestedblock--elasticsearch_connection"></a>
 ### Nested Schema for `elasticsearch_connection`
diff --git a/internal/elasticsearch/security/api_key.go b/internal/elasticsearch/security/api_key.go
index fa8c54414..45928a0a2 100644
--- a/internal/elasticsearch/security/api_key.go
+++ b/internal/elasticsearch/security/api_key.go
@@ -26,6 +26,11 @@ func ResourceApiKey() *schema.Resource {
 			Type:        schema.TypeString,
 			Computed:    true,
 		},
+		"key_id": {
+			Description: "Unique id for this API key.",
+			Type:        schema.TypeString,
+			Computed:    true,
+		},
 		"name": {
 			Description: "Specifies the name for this API key.",
 			Type:        schema.TypeString,
@@ -166,6 +171,9 @@ func resourceSecurityApiKeyCreate(ctx context.Context, d *schema.ResourceData, m
 			return diag.FromErr(err)
 		}
 	}
+	if err := d.Set("key_id", putResponse.Id); err != nil {
+		return diag.FromErr(err)
+	}
 	if err := d.Set("expiration_timestamp", putResponse.Expiration); err != nil {
 		return diag.FromErr(err)
 	}
@@ -230,6 +238,9 @@ func resourceSecurityApiKeyRead(ctx context.Context, d *schema.ResourceData, met
 	if err := d.Set("expiration_timestamp", apikey.Expiration); err != nil {
 		return diag.FromErr(err)
 	}
+	if err := d.Set("key_id", apikey.Id); err != nil {
+		return diag.FromErr(err)
+	}
 
 	if apikey.RolesDescriptors != nil {
 		rolesDescriptors, err := json.Marshal(apikey.RolesDescriptors)
diff --git a/internal/elasticsearch/security/api_key_test.go b/internal/elasticsearch/security/api_key_test.go
index 519e1d6cc..20838770b 100644
--- a/internal/elasticsearch/security/api_key_test.go
+++ b/internal/elasticsearch/security/api_key_test.go
@@ -62,6 +62,7 @@ func TestAccResourceSecurityApiKey(t *testing.T) {
 					resource.TestCheckResourceAttrSet("elasticstack_elasticsearch_security_api_key.test", "expiration"),
 					resource.TestCheckResourceAttrSet("elasticstack_elasticsearch_security_api_key.test", "api_key"),
 					resource.TestCheckResourceAttrSet("elasticstack_elasticsearch_security_api_key.test", "encoded"),
+					resource.TestCheckResourceAttrSet("elasticstack_elasticsearch_security_api_key.test", "id"),
 				),
 			},
 		},