diff --git a/webapp-next/components/login/FormLogin.tsx b/webapp-next/components/login/FormLogin.tsx
index 96afa79..8ed2319 100644
--- a/webapp-next/components/login/FormLogin.tsx
+++ b/webapp-next/components/login/FormLogin.tsx
@@ -105,9 +105,14 @@ export const FormLogin = () => {
   };
 
   const handleModalTermsAccept = async () => {
-    if (cm2dApiKeyEncoded) {
-      cookie.set(ELASTIC_API_KEY_NAME, cm2dApiKeyEncoded);
+    if (code) {
       await triggerCreateUser({ username, versionCGU: '1' });
+      const res = (await triggerVerify({
+        username: username,
+        code: code.toString()
+      })) as any;
+      const result = await res.json();
+      cookie.set(ELASTIC_API_KEY_NAME, result.apiKey.encoded);
       onCloseTerms();
       router.push('/bo');
     }
@@ -126,7 +131,6 @@ export const FormLogin = () => {
       if (res.ok) {
         const result = await res.json();
         if (result.firstLogin) {
-          setCm2dApiKeyEncoded(result.apiKey.encoded);
           onOpenTerms();
         } else {
           cookie.set(ELASTIC_API_KEY_NAME, result.apiKey.encoded);
diff --git a/webapp-next/pages/api/auth/create-user.ts b/webapp-next/pages/api/auth/create-user.ts
index 29ad675..95a2324 100644
--- a/webapp-next/pages/api/auth/create-user.ts
+++ b/webapp-next/pages/api/auth/create-user.ts
@@ -9,31 +9,29 @@ export default async function handler(
   res: NextApiResponse
 ) {
   if (req.method === 'POST') {
-
-    const client = new Client({
+    const adminClient = new Client({
       node: process.env.ELASTIC_HOST,
       auth: {
-        apiKey: req.cookies[ELASTIC_API_KEY_NAME] as string
+        username: process.env.ELASTIC_USERNAME as string,
+        password: process.env.ELASTIC_PASSWORD as string
       },
       tls: {
-        ca: fs.readFileSync(
-          path.resolve(process.cwd(), './certs/ca/ca.crt')
-        ),
+        ca: fs.readFileSync(path.resolve(process.cwd(), './certs/ca/ca.crt')),
         rejectUnauthorized: false
       }
     });
 
     try {
-      await client.create({
-        index: "cm2d_users",
+      await adminClient.create({
+        index: 'cm2d_users',
         id: req.body.username,
         document: {
           username: req.body.username,
-          versionCGU: req.body.versionCGU,
+          versionCGU: req.body.versionCGU
         }
-      })
+      });
 
-      res.status(200).json("OK");
+      res.status(200).json('OK');
     } catch (error) {
       res.status(401).end('Unauthorized');
     }
diff --git a/webapp-next/pages/api/auth/verify-code.ts b/webapp-next/pages/api/auth/verify-code.ts
index 42a64d7..eb3cc65 100644
--- a/webapp-next/pages/api/auth/verify-code.ts
+++ b/webapp-next/pages/api/auth/verify-code.ts
@@ -11,7 +11,6 @@ export default async function handler(
   if (req.method === 'POST') {
     const codeObj = tmpCodes[req.body.username];
     if (codeObj && codeObj.code === req.body.code.toString()) {
-
       let firstLogin = false;
 
       const client = new Client({
@@ -20,23 +19,29 @@ export default async function handler(
           apiKey: codeObj.apiKey.encoded
         },
         tls: {
-          ca: fs.readFileSync(
-            path.resolve(process.cwd(), './certs/ca/ca.crt')
-          ),
+          ca: fs.readFileSync(path.resolve(process.cwd(), './certs/ca/ca.crt')),
           rejectUnauthorized: false
         }
       });
 
       try {
         await client.get({
-          index: "cm2d_users",
+          index: 'cm2d_users',
           id: req.body.username
-        })
+        });
       } catch (e) {
         firstLogin = true;
       }
 
-      res.status(200).json({ apiKey: codeObj.apiKey, firstLogin });
+      res
+        .status(200)
+        .json({
+          apiKey:
+            firstLogin && process.env.NODE_ENV !== 'development'
+              ? undefined
+              : codeObj.apiKey,
+          firstLogin
+        });
     } else {
       res.status(401).end('Unauthorized');
     }