Datadog Authentication: API Keys, App Keys, and Security (2026)

Authentication overview

Datadog utilizes a key-based authentication system to secure access to its Application Programming Interfaces (APIs). This system involves two primary types of credentials: API Keys and Application Keys. These keys work in conjunction to authorize requests made to Datadog's extensive suite of APIs, which include endpoints for submitting metrics, posting events, managing logs, and interacting with other platform features.

The API Key serves as an identifier for your Datadog organization. It is essential for all API requests and helps Datadog identify which account the request originates from. The Application Key, on the other hand, provides a more granular layer of authentication. It identifies the specific user or application within your organization that is making the request, enabling better auditing and access control. This dual-key approach enhances security by separating organizational identification from user-specific access, allowing for more precise permission management and easier credential rotation.

Proper management and secure handling of these keys are critical to maintaining the integrity and security of your Datadog environment. Datadog provides a dedicated section within its web interface for generating, managing, and revoking these credentials, ensuring administrators have full control over API access within their organization.

Supported authentication methods

Datadog's API authentication primarily relies on a combination of API Keys and Application Keys. These are typically passed as HTTP headers or query parameters, depending on the specific API endpoint and client library used. While API Keys identify the organization, Application Keys provide user-specific or application-specific authorization. Datadog's SDKs abstract much of the complexity, allowing developers to configure credentials through environment variables or direct instantiation.

Key-based authentication

This is the standard and recommended method for authenticating with Datadog APIs. It provides a straightforward yet secure way to manage access for automated scripts, integrations, and developer tools. The two types of keys each serve a distinct purpose:

• API Key: This key identifies your Datadog organization. It is required for nearly all API requests and links the request to your account. You can have multiple API Keys, which is useful for different environments (e.g., development, staging, production) or for different integration partners, allowing for easier key rotation and revocation without impacting all services.
• Application Key: This key identifies the specific user or application making the request within your organization. Each Application Key can be associated with a specific user account or service account, enabling fine-grained access control and audit trails. For example, you might create a distinct Application Key for a monitoring script, another for a CI/CD pipeline, and individual keys for different developers.

These keys are typically passed in HTTP headers for REST API calls:

DD-API-KEY: <YOUR_API_KEY>
DD-APPLICATION-KEY: <YOUR_APPLICATION_KEY>

Datadog also supports integrating with SAML 2.0 for single sign-on (SSO) for user authentication to the Datadog web application, but API programmatic access remains key-based.

Authentication methods table

The following table summarizes the primary authentication methods for programmatic access:

Getting your credentials

Accessing and managing your Datadog API and Application Keys is done through the Datadog web interface. You must have appropriate administrative permissions within your Datadog organization to generate or revoke these keys.

Steps to generate API Keys:

1. Log in to your Datadog account.
2. Navigate to Organization Settings > API Keys.
3. Click the New Key button.
4. Provide a descriptive name for the API Key (e.g., "Production Metrics Ingest").
5. Click Create API Key.
6. Copy the newly generated key. It will only be fully visible once.

Steps to generate Application Keys:

1. Log in to your Datadog account.
2. Navigate to Organization Settings > Application Keys.
3. Click the New Key button.
4. Provide a descriptive name for the Application Key (e.g., "CI/CD Pipeline Integration").
5. Optionally, associate the key with a specific user by selecting from the dropdown.
6. Click Create Application Key.
7. Copy the newly generated key.

It is crucial to store these keys securely immediately after generation. Datadog will not display the full key again after you leave the page. If a key is lost, it must be revoked and a new one generated.

Authenticated request example

This example demonstrates how to make an authenticated API request to Datadog using Python. It uses the official Datadog Python client library, which simplifies API interactions by handling header construction and request signing.

First, ensure you have the Datadog API client library installed:

pip install datadog-api-client

Next, set your API and Application Keys as environment variables. This is a recommended practice for keeping credentials out of your codebase:

export DD_API_KEY="<YOUR_API_KEY>"
export DD_APPLICATION_KEY="<YOUR_APPLICATION_KEY>"

Now, you can use the Python client to post a custom metric:

from datadog_api_client import ApiClient, Configuration
from datadog_api_client.v2.api.metrics_api import MetricsApi
from datadog_api_client.v2.model.metric_intake_series import MetricIntakeSeries
from datadog_api_client.v2.model.metric_series import MetricSeries
from datadog_api_client.v2.model.metric_payload import MetricPayload
import time
import os

# Configure API keys from environment variables
configuration = Configuration()

# Initialize the API client
with ApiClient(configuration) as api_client:
    api_instance = MetricsApi(api_client)

    # Prepare the metric payload
    body = MetricPayload(
        series=[
            MetricSeries(
                metric="my.custom.metric",
                type="gauge",
                points=[
                    MetricIntakeSeries(
                        timestamp=int(time.time()),
                        value=12.34,
                    ),
                ],
                tags=["env:dev", "service:example"],
            ),
        ],
    )

    try:
        # Send the metric
        response = api_instance.submit_metrics(body=body)
        print(f"Metric submission successful: {response}")
    except Exception as e:
        print(f"Error submitting metric: {e}")

This example demonstrates how the Datadog client library automatically handles the inclusion of the DD-API-KEY and DD-APPLICATION-KEY headers based on the environment variables, simplifying the authentication process for developers. For other SDKs and direct API calls, refer to the Datadog API documentation.

Security best practices

Securing your Datadog API and Application Keys is paramount to protecting your monitoring data and infrastructure. Adhering to security best practices helps prevent unauthorized access and potential data breaches.

1. Secure storage of credentials

• Environment Variables: Store keys as environment variables rather than hardcoding them directly into your application code. This prevents accidental exposure in version control systems and makes key rotation easier.
• Secrets Management Systems: For production environments, utilize dedicated secrets management solutions like AWS Secrets Manager, Google Secret Manager, Azure Key Vault, HashiCorp Vault, or Firebase Secret Manager. These systems provide centralized, encrypted storage and controlled access to sensitive credentials.
• Avoid Public Repositories: Never commit API or Application Keys to public or private source code repositories. Use .gitignore files to exclude configuration files containing credentials.

2. Principle of Least Privilege

• Limit Key Scope: Generate Application Keys with only the necessary permissions required for the task at hand. Datadog allows assigning specific roles and permissions to Application Keys, ensuring that a compromised key cannot access or modify unrelated parts of your Datadog account.
• Dedicated Keys: Create unique Application Keys for each service, application, or individual developer that interacts with the Datadog API. This allows for precise revocation if a key is compromised without affecting other services.

3. Key rotation and lifecycle management

• Regular Rotation: Implement a policy for regularly rotating API and Application Keys (e.g., every 90 days). Automated rotation, where supported by your secrets management solution, is highly recommended.
• Immediate Revocation: If you suspect a key has been compromised, revoke it immediately through the Datadog web interface.
• Monitor Key Usage: Regularly review the audit logs for your Datadog account to detect any unusual or unauthorized API key usage.

4. Network security

• Restrict Access: Where possible, configure network firewalls or security groups to restrict API access to Datadog from known IP addresses or ranges.
• TLS/SSL: Always ensure that all communications with the Datadog API are conducted over HTTPS (TLS/SSL) to encrypt data in transit. The Datadog SDKs automatically enforce this.

5. Logging and monitoring

• Enable Audit Trails: Leverage Datadog's own audit trails and security monitoring features to track API key usage, key generation, and key revocation events.
• Alerting: Set up alerts for suspicious activities related to API key management, such as a high volume of failed authentication attempts or unexpected key deletions.

By implementing these practices, organizations can significantly reduce the risk associated with API key management and maintain a secure observability environment with Datadog.