API keys

Create a project key, limit it to one environment, and revoke it.

An API key lets an application send traces, logs, and metrics to one project. Each key starts with td_live_.

An organization owner or admin can create and revoke keys. Members can see the key list.

Create a key

A new project also gets a key named default. The Project created dialog shows it one time.

The key list shows each key’s Name, the first 16 characters of the Key, its Environment (or All environments), its Status (Active or Revoked), and when it was Created.

Send telemetry with the key

Send the key as a bearer token in the Authorization header of each OTLP request:

Authorization: Bearer td_live_your_key

The telemetry.dev SDKs read the key from an environment variable:

export TELEMETRY_DEV_API_KEY="td_live_your_key"

A missing, malformed, unknown, or revoked key gets 401 invalid_api_key. For exporter settings, read Send OTLP/HTTP from any language. For all error codes, read OTLP error responses.

Limit a key to one environment

Enter an Environment when you create the key, such as production. Leave it empty to accept every environment. You cannot change the environment of an existing key.

An environment-limited key accepts a request only if every resource block in it has that environment. The comparison ignores letter case and spaces at either end. The key also rejects spans for a trace that is already stored under another environment.

In both cases, the ingest service rejects the request with 403 environment_mismatch. A mismatch in one resource block rejects the whole request, including blocks that match.

Telemetry without an environment attribute is accepted and gets the key’s environment. Read Set the environment.

Revoke a key

Select Revoke in the key’s row, then select Revoke key to confirm.

The ingest service checks the key on every request, so the key stops working right away. The key stays in the list as Revoked. You cannot turn it back on.

Deleting a project also deletes all of its keys.