Control API access to Dash0 in a granular and secure way using Auth Tokens.

Auth tokens authenticate and authorize users and services when accessing Dash0's APIs. They are of the form auth_abc123.... Use them to send telemetry to Dash0 and to integrate Dash0 with other solutions, for example Grafana or Terraform.

Each token belongs to exactly one organization. Only Admins can create, view, and delete auth tokens, in Settings → Auth Tokens. The settings also show whether a token is still in use.

Managing auth tokens

Auth tokens have the following settings:

Name: A required label for the token. Pick a name that identifies the sender or the intended use, so you know what breaks when you revoke the token.
Dataset: The datasets the token may access. See Dataset access.
Default ingestion dataset: The dataset Dash0 uses when a telemetry write request does not specify the dataset. See Default ingestion dataset.
Signal types: The signal types the token may ingest. See Signal types.
Permissions: What the token may do (telemetry ingestion, querying data). See Permissions.

We recommend that you give each token the narrowest possible settings that still cover its intended use.

Dataset access

The Dataset field controls which datasets a token may access. The restriction applies to every dataset-scoped operation. The token can only ingest and query telemetry for the specifiied datasets, and it can only read and change dataset-scoped assets such as dashboards and check rules. Requests that target any other dataset fail.

The field is a multi-select with two ways to use it:

All datasets: The default. The token may access every dataset in the organization, including datasets created after the token.
Specific datasets: Select one or more datasets by name. The token can only access those datasets.

Default ingestion dataset

Every token also has a Default ingestion dataset. Dash0 writes telemetry to this dataset when the telemetry write request does not specify a dataset.

A request specifies a dataset through the Dash0-Dataset header.

When you restrict a token to specific datasets, the Default ingestion dataset dropdown offers only those datasets. A token restricted to a single dataset therefore always falls back to that one dataset.

Signal types

The Signal types field restricts which signals a token may ingest. Leave it at All signal types, or select any combination of Logs, Metrics, Spans, Profiles, and Web events. When you restrict it, Dash0 only accepts the selected signal types from that token.

Permissions

The Permissions field controls what the token may do:

All permissions (querying, ingesting and configuring): The default. Grants access to the full Dash0 API for configuration, allows telemetry ingestion and querying data.
Ingesting: The token can only send telemetry.
Reading: The token can only query data.

Restrict tokens to Ingesting whenever you distribute them publicly, for example in OpenTelemetry instrumentation running in web browsers or mobile apps. Such a token is readable by anyone using the app, and an ingestion-only token cannot read your telemetry back or change your configuration.

How Dash0 routes ingested telemetry

The token's Dataset and Default ingestion dataset settings together decide where telemetry lands:

Dataset setting	Request specifies a permitted dataset	Request specifies a dataset outside the token's permissions	Request does not specify a dataset
All datasets	Written to the specified dataset	Cannot happen, every dataset is permitted	Written to the default ingestion dataset
Several specific datasets	Written to the specified dataset	Rejected with an error	Written to the default ingestion dataset
A single dataset	Written to the specified dataset	Rejected with an error	Written to the single allowed dataset

Note

Dash0 rejects the request when it specifies a dataset the token may not write to. It does not fall back to the default ingestion dataset. Telemetry sent this way is lost. Check the Dataset setting of a token before you point a new sender at it.

Auth Tokens