Scoped API keys

Issue one credential per workload, limited to the signals it needs.

1 min read Updated Oct 21, 2026 Sentinel Platform Team

api-keysscopescredentialssecurity

Why scopes #

An unscoped key can write to every signal your deployment accepts. A scoped key can only write to the signals you named, so a compromised log-forwarding credential cannot write spans.

Scopes #

logs — send logs.
traces — send spans.
metrics — send metrics.
dbm — send database monitoring spans.
profiles — send profiles.
probes — pull dynamic instrumentation configuration.

A key with no scopes carries all of them, which is convenient for a first test and rarely what you want in production.

Creating a key #

API key

{
  "name": "checkout-worker-prod",
  "scopes": ["traces", "logs"],
  "owner_email": "platform@acme.example",
  "expires_at": "2027-01-01T00:00:00Z"
}

Name — what the workload is, so it is identifiable later.
Scopes — the signals this credential may write.
Owner email — who to ask about it.
Expiry — an optional date after which the key stops working.

Choosing scopes #

A web service sending traces and metrics needs traces and metrics.
A log shipper needs logs.
A profiling agent needs profiles.
The infrastructure agent needs probes and metrics.

Expiry #

Set an expiry on keys that belong to workloads you deploy on a schedule. A key that expires on its own removes a credential you forgot about.

Scope is checked per request

A request whose key lacks the scope for that endpoint is refused. The refusal names the endpoint, which makes a misconfigured sender obvious immediately.

Rotating #

Create the replacement key first.
Update the workload to use it.
Revoke the old key once the workload is confirmed on the new one.

One key per workload, named for the workload. When something misbehaves, the key tells you which deployment to look at.

Onward #

A key is for a workload; the human side is Identity and roles, and an automation that acts on your behalf rather than reporting to you uses an application key from the same page. Key creation and revocation are recorded in the Audit trail, and what your collectors send under these keys is Ingestion controls.