Ingest keys

An ingest key is a project’s credential for sending telemetry. Your services and Collectors send it as authorization: Bearer ezgh_ik_… with every OTLP request.

• It can only send data: the actions in its allowed actions (obs.logs.ingest, obs.traces.ingest and obs.metrics.ingest, chosen with --action) and only to its own project. It can’t read logs, call any other API or act as anyone.
• It belongs to the project. It keeps working when the person who created it leaves the organization, and stops when it’s revoked, or when its project or organization is deleted, suspended or closed.
• Only ingest keys are accepted for sending logs. API keys, CLI logins and console sessions are refused with 401. Ingest keys are refused by every other API.
• No escalation: to create a key, you need every action it allows on that project, as well as ingestKeys.create. A key allows at most 20 actions.
• It’s a resource: a UUID ID, an igk_… slug and the resource name ezgh::org_…:prj_…:igk_…, which policies can name.

Create a key

The secret is shown once, when the key is created. Store it in your secret manager right away.

ezgh ingest-keys create otel-collector --project web > ingest-key.txt

ezgh prints the secret alone on stdout, and how to use it on stderr. -o json prints { ingestKey, token } instead. See ezgh ingest-keys create.

Use a key

Set it for the OpenTelemetry SDK or Collector, never in code:

export OTEL_EXPORTER_OTLP_ENDPOINT=https://obs-ingest.ezghcloud.com
export OTEL_EXPORTER_OTLP_HEADERS="authorization=Bearer%20$(cat ingest-key.txt)"

OTEL_EXPORTER_OTLP_HEADERS uses the W3C Baggage format, so the space after Bearer is written %20; SDKs decode it. In a Collector’s YAML, write the header with a plain space: authorization: "Bearer ${env:EZGH_INGEST_KEY}".

List, inspect and revoke keys

ezgh ingest-keys list --project web
ezgh ingest-keys get otel-collector --project web
ezgh ingest-keys revoke otel-collector --project web

• Keys are listed newest first, with their prefix (the first 12 characters, ezgh_ik_Ab3d…), never their secret.
• Revoked keys stay in the list with the time they were revoked.
• A revoked key is refused within seconds, with 401 / UNAUTHENTICATED.

To replace a key without a gap:

1. Create a new one.
2. Deploy it.
3. Revoke the old one when no sender uses it.

The Organizations API has the same operations for a project’s ingest keys; see the Organizations API reference.

Trails

Creating and revoking a key are recorded in Trails as management events, without the secret.