> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Datadog Connection

> Learn how to configure a Datadog Connection for Infisical.

Infisical supports two methods for authenticating with Datadog:

* **Service Access Token** (recommended): a Datadog [Service Access Token](https://docs.datadoghq.com/account_management/service-access-tokens/) issued on a Service Account and sent as a bearer token (`Authorization: Bearer <token>`).
* **Application Keys**: a Datadog [API Key](https://docs.datadoghq.com/account_management/api-app-keys/) paired with a Service Account [Application Key](https://docs.datadoghq.com/account_management/org_settings/service_accounts/).

<Note>
  We recommend the **Service Access Token** method. Tokens are scoped, can be given an expiration, and are bound to a dedicated Service Account, so the credentials Infisical uses can be rotated and revoked independently of any individual user. The **Application Keys** method remains available for existing setups.
</Note>

## Create Datadog Credentials

<Tabs>
  <Tab title="Service Access Token (Recommended)">
    <Steps>
      <Step title="Open Organization Settings">
        From your Datadog dashboard, hover the bottom left where it says **Integrations**. This will open a window with **Organization Settings**

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/open-settings.png" alt="Open Organization Settings" />
      </Step>

      <Step title="Navigate to Service Accounts">
        In **Organization Settings**, open the **Service Accounts** section from the left sidebar.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/service-account-option.png" alt="Service Accounts Option" />
      </Step>

      <Step title="Create a New Service Account">
        On the **Service Accounts** page, click **New Service Account**.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/service-account-page.png" alt="Service Accounts Page" />
      </Step>

      <Step title="Create the Service Account">
        Provide a name, email, and select a role for the Service Account, then click **Create Service Account**.

        <Note>
          The Service Account's role determines which resources Infisical can access. Make sure it has access to the resources you want Infisical to manage. For secret rotation, it is required to have the `Datadog Admin Role` as a base so the token can be scoped.
        </Note>

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/create-service-account.png" alt="Create Service Account" />
      </Step>

      <Step title="Open the New Service Account">
        Once created, click the Service Account in the list to open its details, where you can manage its **Access Tokens**.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/service-account-created.png" alt="Service Account Created" />
      </Step>

      <Step title="Create an Access Token">
        In the Service Account's details panel, find the **Access Tokens** section and click **+ New Token**.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/create-access-token.png" alt="Create Access Token" />
      </Step>

      <Step title="Name the Access Token">
        Enter a descriptive **Name** for the token (e.g. `infisical-connection`) and choose an **Expiration Date** (`1 day`, `1 month`, `1 year`, `Never`, or `Custom`).

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/access-token-name.png" alt="Access Token Name" />
      </Step>

      <Step title="Configure Access Token Scopes">
        Click **Select Scopes** to define what the token can access. Grant only the permissions your workflow requires, then click **Save**.

        <Tabs>
          <Tab title="Application Key Rotation">
            For [Datadog Application Key Secret Rotation](/docs/documentation/platform/secret-rotation/datadog-application-key-secret), the token needs scopes to read users and manage Service Account Application Keys. Set `user_app_keys` under **API and Application Keys** and `service_account_write`, `user_access_manage`, and `user_access_read` under **Access Management**.

            <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/access-token-scopes.png" alt="Application Key button" />
          </Tab>

          <Tab title="API Key Rotation">
            For [Datadog API Key Secret Rotation](/docs/documentation/platform/secret-rotation/datadog-api-key), the token needs scopes to delete and read API Keys. Set `api_keys_delete` and `api_keys_write` under **API and Application Keys**.

            <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/api-key-rotation-permissions.png" alt="API key rotation" />
          </Tab>
        </Tabs>
      </Step>

      <Step title="Copy the Access Token Value">
        Datadog displays the token secret **only once** at creation time. Copy the **token value** and store it somewhere safe. You will need it when creating the Infisical connection.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/copy-access-token.png" alt="Copy Access Token" />
      </Step>
    </Steps>
  </Tab>

  <Tab title="Application Keys">
    <Steps>
      <Step title="Open Organization Settings">
        From your Datadog dashboard, hover the bottom left where it says  **Integrations**. This will open a window with **Organization Settings**

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/open-settings.png" alt="Open Organization Settings" />
      </Step>

      <Step title="Navigate to API Keys">
        In the left sidebar, select **API Keys**.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/api-key-option.png" alt="API Keys Option" />
      </Step>

      <Step title="Create a New API Key">
        Click the **New Key** button in the top-right corner.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/new-key-button.png" alt="New API Key Button" />
      </Step>

      <Step title="Name the API Key">
        Provide a descriptive name for the API Key (e.g. `infisical-connection`) and click **Create Key**.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/api-key-name-modal.png" alt="Name API Key" />
      </Step>

      <Step title="Copy the API Key Value">
        Copy the generated **API Key** value and store it somewhere safe. You will need it when creating the Infisical connection.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/api-key-copy-value.png" alt="Copy API Key" />
      </Step>

      <Step title="Navigate to Service Accounts">
        Back in **Organization Settings**, open the **Service Accounts** section from the left sidebar.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/service-account-option.png" alt="Service Accounts Option" />
      </Step>

      <Step title="View Service Accounts">
        On the **Service Accounts** page, click **New Service Account**.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/service-account-page.png" alt="Service Accounts Page" />
      </Step>

      <Step title="Create the Service Account">
        Provide a name, email, and select a role for the Service Account, then click **Create Service Account**.

        <Note>
          The Service Account's role determines which resources Infisical can access. Make sure it has access to the resources you want Infisical to manage. For secret rotation, it is required to have the `Datadog Admin Role` as a base so the **Application Key can be scoped**
        </Note>

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/create-service-account.png" alt="Create Service Account" />
      </Step>

      <Step title="Open the New Service Account">
        Once created, click on created the Service Account from the list to manage its Application Keys.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/service-account-created.png" alt="Service Account Created" />
      </Step>

      <Step title="Create an Application Key">
        Under the **Application Keys** section of the Service Account, click **New Key**.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/create-new-key.png" alt="Create Application Key" />
      </Step>

      <Step title="Define a name for the Application Key ">
        Define a name for the application key

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/application-key-name.png" alt="Application Key Name" />
      </Step>

      <Step title="Configure Application Key Scopes">
        Assign the scopes required for your use case. On **Scope** click on **Edit**, so you can define the scopes you want. If this is left empty, the scope of this key will be the same as the service account.

        <Tabs>
          <Tab title="Application Key Rotation">
            For [Datadog Application Key Secret Rotation](/docs/documentation/platform/secret-rotation/datadog-application-key-secret), the token needs scopes to read users and manage Service Account Application Keys. Set `user_app_keys` under **API and Application Keys** and `service_account_write`, `user_access_manage`, and `user_access_read` under **Access Management**.

            <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/access-token-scopes.png" alt="Application Key button" />
          </Tab>

          <Tab title="API Key Rotation">
            For [Datadog API Key Secret Rotation](/docs/documentation/platform/secret-rotation/datadog-api-key), the token needs scopes to delete and read API Keys. Set `api_keys_delete` and `api_keys_write` under **API and Application Keys**.

            <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/api-key-rotation-permissions.png" alt="API key rotation" />
          </Tab>
        </Tabs>
      </Step>

      <Step title="Copy the Application Key Value">
        Copy the **Application Key** value and store it somewhere safe. You will need it when creating the Infisical connection.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/copy-service-account-key.png" alt="Application Key Scopes" />
      </Step>
    </Steps>
  </Tab>
</Tabs>

## Create Datadog Connection in Infisical

<Tabs>
  <Tab title="Infisical UI">
    <Steps>
      <Step title="Navigate to App Connections">
        In your Infisical dashboard, navigate to the **Integrations** tab in the desired project, then select **App Connections**.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/general/add-connection.png" alt="App Connections Tab" />
      </Step>

      <Step title="Select Datadog Connection">
        Click the \*\* Add Connection\*\* button and select **Datadog** from the list of available connections.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/datadog-add-connection.png" alt="Datadog Connection form" />
      </Step>

      <Step title="Fill out the Datadog Connection Modal">
        Complete the Datadog Connection form by entering:

        * A descriptive name for the connection
        * An optional description for future reference
        * The **Method** you want to use to authenticate (**Service Access Token**, recommended, or **Application Keys**)
        * The Datadog **URL** for your region (e.g. `https://api.datadoghq.com`, `https://api.us5.datadoghq.com`, or `https://api.ddog-gov.com`)
        * If using **Service Access Token**: the Datadog **Service Access Token**
        * If using **Application Keys**: the **API Key** and the Service Account **Application Key** from the earlier steps

                  <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/datadog-form.png" alt="Datadog Connection form" />
      </Step>

      <Step title="Connection Created">
        After clicking Create, your **Datadog Connection** is established and ready to use with your Infisical project.

        <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/datadog/datadog-app-connection.png" alt="Datadog Connection form" />
      </Step>
    </Steps>
  </Tab>

  <Tab title="API">
    To create a Datadog Connection, make an API request to the [Create Datadog Connection](/docs/api-reference/endpoints/app-connections/datadog/create) API endpoint.

    ### Sample request

    <CodeGroup>
      ```bash Service Access Token (Recommended) theme={"dark"}
      curl    --request POST \
              --url https://app.infisical.com/api/v1/app-connections/datadog \
              --header 'Content-Type: application/json' \
              --data '{
                  "name": "my-datadog-connection",
                  "method": "token",
                  "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
                  "credentials": {
                      "url": "https://api.datadoghq.com",
                      "token": "<YOUR-SERVICE-ACCESS-TOKEN>"
                  }
              }'
      ```

      ```bash Application Keys theme={"dark"}
      curl    --request POST \
              --url https://app.infisical.com/api/v1/app-connections/datadog \
              --header 'Content-Type: application/json' \
              --data '{
                  "name": "my-datadog-connection",
                  "method": "api-key",
                  "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
                  "credentials": {
                      "url": "https://api.datadoghq.com",
                      "apiKey": "<YOUR-API-KEY>",
                      "applicationKey": "<YOUR-APPLICATION-KEY>"
                  }
              }'
      ```
    </CodeGroup>

    ### Sample response

    ```bash Response theme={"dark"}
    {
      "appConnection": {
          "id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
          "name": "my-datadog-connection",
          "projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
          "description": null,
          "version": 1,
          "orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
          "createdAt": "2025-04-23T19:46:34.831Z",
          "updatedAt": "2025-04-23T19:46:34.831Z",
          "isPlatformManagedCredentials": false,
          "credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
          "app": "datadog",
          "method": "api-key",
          "credentials": {
              "url": "https://api.datadoghq.com"
          }
      }
    }
    ```
  </Tab>
</Tabs>