---
title: "Ingest keys"
description: "Create, use and revoke the project credential your services send logs with."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Ingest keys

An ingest key is a project's credential for sending telemetry. Your services and Collectors send
it as `authorization: Bearer ezgh_ik_…` with every OTLP request.

- **It can only send data:** the actions in its allowed actions (`obs.logs.ingest`,
  `obs.traces.ingest` and `obs.metrics.ingest`, chosen with `--action`) and only to its own
  project. It can't read logs, call any other API or act as anyone.
- **It belongs to the project.** It keeps working when the person who created it leaves the
  organization, and stops when it's revoked, or when its project or organization is deleted,
  suspended or closed.
- **Only ingest keys are accepted** for sending logs. API keys, CLI logins and console sessions
  are refused with `401`. Ingest keys are refused by every other API.
- **No escalation:** to create a key, you need every action it allows on that project, as well as
  `ingestKeys.create`. A key allows at most 20 actions.
- **It's a resource:** a UUID ID, an `igk_…` slug and the resource name
  `ezgh::org_…:prj_…:igk_…`, which policies can name.

## Create a key

The secret is shown once, when the key is created. Store it in your secret manager right away.

```sh
ezgh ingest-keys create otel-collector --project web > ingest-key.txt
```

`ezgh` prints the secret alone on stdout, and how to use it on stderr. `-o json` prints
`{ ingestKey, token }` instead. See [`ezgh ingest-keys create`](/cli/reference/ingest-keys-create).

## Use a key

Set it for the OpenTelemetry SDK or Collector, never in code:

```sh
export OTEL_EXPORTER_OTLP_ENDPOINT=https://obs-ingest.ezghcloud.com
export OTEL_EXPORTER_OTLP_HEADERS="authorization=Bearer%20$(cat ingest-key.txt)"
```

`OTEL_EXPORTER_OTLP_HEADERS` uses the W3C Baggage format, so the space after `Bearer` is written
`%20`; SDKs decode it. In a Collector's YAML, write the header with a plain space:
`authorization: "Bearer ${env:EZGH_INGEST_KEY}"`.

## List, inspect and revoke keys

```sh
ezgh ingest-keys list --project web
ezgh ingest-keys get otel-collector --project web
ezgh ingest-keys revoke otel-collector --project web
```

- Keys are listed newest first, with their prefix (the first 12 characters, `ezgh_ik_Ab3d…`), never their secret.
- Revoked keys stay in the list with the time they were revoked.
- A revoked key is refused within seconds, with `401` / `UNAUTHENTICATED`.

To replace a key without a gap:
1. Create a new one.
2. Deploy it.
3. Revoke the old one when no sender uses it.

The Organizations API has the same operations for a project's ingest keys; see the
[Organizations API reference](/orgs-api).

## Trails

Creating and revoking a key are recorded in [Trails](/trails) as management events, without the
secret.

Source: https://docs.ezghcloud.com/observability/ingest-keys/index.mdx