Dash0 CLI: OAuth support, OTLP proxy, and more!

OAuth login

OAuth support was the most requested (by a wide margin!) feature request for the dash0Copy CLI.

dash0 loginCopy opens your browser, completes the OAuth 2.0 + PKCE flow, and stores the resulting access and refresh tokens in your profile. Access tokens refresh transparently before they expire. Static auth_*Copy tokens still work, although when you change a profile to use OAuth, the previous access token gets overwritten.

Create an OAuth profile and authenticate:

123
dash0 config profiles create prod --oauth \
  --api-url https://api.eu-west-1.aws.dash0.com
dash0 login --profile prod

dash0 config showCopy annotates the auth state, so you always see whether a token is static, OAuth-active (with remaining lifetime), or OAuth-empty:

123
Profile:    prod
API URL:    https://api.eu-west-1.aws.dash0.com
Auth Token: ...1234567    (OAuth, expires in 14m20)

The dash0Copy CLI will refresh the authentication token when it expires, using the refresh token, so the actual expiration and refresh of auth tokens will be invisible for you.

When you're done, revoke the refresh token and clear the profile with:

1
dash0 logout --profile prod

Safe by default for AI agents: When Claude Code, Cursor, or another coding agent invokes the CLI, dash0 loginCopy refuses to open a browser and dash0 logoutCopy requires explicit --forceCopy — so an agent cannot silently rotate or revoke a profile's OAuth session. Errors point agents at the recovery paths instead:

1234
$ dash0 logs query
Error: profile "prod" is OAuth-typed but not authenticated.
Hint: set DASH0_AUTH_TOKEN to a static `auth_*` token, or convert the profile with
      `dash0 config profiles update prod --oauth=false --auth-token auth_<...> --force`.

Local OTLP proxy

If you have worked with OpenTelemetry for a long time, you probably have some sort of local OpenTelemetry Collector setup working. But what if we could make it dead simple to send telemetry to Dash0 from your local apps? Enter dash0 otlp proxyCopy.

dash0 -X otlp proxyCopy runs a foreground forwarder on 127.0.0.1:4318Copy (OTLP/HTTP) and 127.0.0.1:4317Copy (OTLP/gRPC) — the OpenTelemetry SDK defaults — and ships the telemetry it receives to Dash0 with your active profile's credentials. An SDK at default endpoint configuration connects with zero environment-variable changes.

Just run it:

1234
dash0 otlp proxy listening — http://127.0.0.1:4318 (OTLP/HTTP), 127.0.0.1:4317 (OTLP/gRPC) — profile: dev (dataset: default)
   logs:    42/s ▁▂▄▆▇ 1234 total
  spans:    18/s ▁▂▃▄▅  540 total
metrics:     0/s ▁▁▁▁▁    0 total

You will also see the rate at which you are sending data and how much you have sent in total. This should reduce your FUD when trying to get your OTel setup going!

You can also tag forwarded traffic so individual developers can filter their telemetry on a shared backend:

123
dash0 -X otlp proxy \
  --resource-attribute developer=alice \
  --resource-attribute deployment.environment.name=local

Or watch every forwarded record in the same style as the Collector's debug exporter while you iterate on instrumentation:

1
dash0 -X otlp proxy --tail

Note: The proxy is a local-dev shortcut, not a replacement for the OpenTelemetry Collector — see the docs for the agent-mode event schema and failure-mode classification.

Precision mode for queries

By default the Dash0 API applies adaptive sampling to log and span queries — fast on large datasets, statistically representative for exploration. For narrow lookups that must return every match (a specific trace.idCopy, a test.idCopy from CI, a request ID), pass --precision disabledCopy:

12
dash0 logs query --precision disabled --filter "test.id is 7a3f…"
dash0 spans query --precision disabled --filter "trace.id is 0af7651916cd43dd8448eb211c80319c"

traces getCopy always runs in Precision mode, so a retrieved trace is never missing spans regardless of the query window.

Streamlined Homebrew install

The CLI's Homebrew distribution has moved to a dedicated tap (dash0hq/homebrew-dash0-cliCopy) and switched from a formula to a cask, which is Homebrew's recommended mechanism for pre-built CLI binaries.

New users install with a single command — no brew tapCopy, no brew trustCopy (introduced with Homebrew 6.0):

1
brew install --cask dash0hq/dash0-cli/dash0

Existing users see a deprecation warning on brew upgrade dash0Copy pointing at the new path. The migration is a one-time three-step procedure:

123
brew uninstall dash0
brew untap dash0hq/dash0-cli
brew install --cask dash0hq/dash0-cli/dash0

Note: We plan to keep supporting the legacy tap as well, but you will need trust to it via Homebrew. Casks are a better way to get your latest dash0Copy CLI.

See the full migration guide for context on the Homebrew 6.0 tap-trust changes that motivated the move.

Available now!

All this is available now in Dash0 CLI 1.14.0. Upgrade via Homebrew with brew upgrade --cask dash0Copy (after migrating from the legacy formula), pull the latest container with docker pull ghcr.io/dash0hq/cli:latestCopy, or download a binary directly from the GitHub release.