docs/integrations/app-connections/datadog.mdx
Infisical supports two methods for authenticating with Datadog:
Authorization: Bearer <token>). 
</Step>
<Step title="Navigate to Service Accounts">
In **Organization Settings**, open the **Service Accounts** section from the left sidebar.
</Step>
<Step title="Create a New Service Account">
On the **Service Accounts** page, click **New Service Account**.
</Step>
<Step title="Create the Service Account">
Provide a name, email, and select a role for the Service Account, then click **Create Service Account**.
<Note>
The Service Account's role determines which resources Infisical can access. Make sure it has access to the resources you want Infisical to manage. For secret rotation, it is required to have the `Datadog Admin Role` as a base so the token can be scoped.
</Note>
</Step>
<Step title="Open the New Service Account">
Once created, click the Service Account in the list to open its details, where you can manage its **Access Tokens**.
</Step>
<Step title="Create an Access Token">
In the Service Account's details panel, find the **Access Tokens** section and click **+ New Token**.
</Step>
<Step title="Name the Access Token">
Enter a descriptive **Name** for the token (e.g. `infisical-connection`) and choose an **Expiration Date** (`1 day`, `1 month`, `1 year`, `Never`, or `Custom`).
</Step>
<Step title="Configure Access Token Scopes">
Click **Select Scopes** to define what the token can access. Grant only the permissions your workflow requires, then click **Save**.
<Tabs>
<Tab title="Application Key Rotation">
For [Datadog Application Key Secret Rotation](/documentation/platform/secret-rotation/datadog-application-key-secret), the token needs scopes to read users and manage Service Account Application Keys. Set `user_app_keys` under **API and Application Keys** and `service_account_write`, `user_access_manage`, and `user_access_read` under **Access Management**.
</Tab>
<Tab title="API Key Rotation">
For [Datadog API Key Secret Rotation](/documentation/platform/secret-rotation/datadog-api-key), the token needs scopes to delete and read API Keys. Set `api_keys_delete` and `api_keys_write` under **API and Application Keys**.
</Tab>
</Tabs>
</Step>
<Step title="Copy the Access Token Value">
Datadog displays the token secret **only once** at creation time. Copy the **token value** and store it somewhere safe. You will need it when creating the Infisical connection.
</Step>
</Steps>
</Tab>
<Tab title="Application Keys">
<Steps>
<Step title="Open Organization Settings">
From your Datadog dashboard, hover the bottom left where it says **Integrations**. This will open a window with **Organization Settings**
</Step>
<Step title="Navigate to API Keys">
In the left sidebar, select **API Keys**.
</Step>
<Step title="Create a New API Key">
Click the **New Key** button in the top-right corner.
</Step>
<Step title="Name the API Key">
Provide a descriptive name for the API Key (e.g. `infisical-connection`) and click **Create Key**.
</Step>
<Step title="Copy the API Key Value">
Copy the generated **API Key** value and store it somewhere safe. You will need it when creating the Infisical connection.
</Step>
<Step title="Navigate to Service Accounts">
Back in **Organization Settings**, open the **Service Accounts** section from the left sidebar.
</Step>
<Step title="View Service Accounts">
On the **Service Accounts** page, click **New Service Account**.
</Step>
<Step title="Create the Service Account">
Provide a name, email, and select a role for the Service Account, then click **Create Service Account**.
<Note>
The Service Account's role determines which resources Infisical can access. Make sure it has access to the resources you want Infisical to manage. For secret rotation, it is required to have the `Datadog Admin Role` as a base so the **Application Key can be scoped**
</Note>
</Step>
<Step title="Open the New Service Account">
Once created, click on created the Service Account from the list to manage its Application Keys.
</Step>
<Step title="Create an Application Key">
Under the **Application Keys** section of the Service Account, click **New Key**.
</Step>
<Step title="Define a name for the Application Key ">
Define a name for the application key
</Step>
<Step title="Configure Application Key Scopes">
Assign the scopes required for your use case. On **Scope** click on **Edit**, so you can define the scopes you want. If this is left empty, the scope of this key will be the same as the service account.
<Tabs>
<Tab title="Application Key Rotation">
For [Datadog Application Key Secret Rotation](/documentation/platform/secret-rotation/datadog-application-key-secret), the token needs scopes to read users and manage Service Account Application Keys. Set `user_app_keys` under **API and Application Keys** and `service_account_write`, `user_access_manage`, and `user_access_read` under **Access Management**.
</Tab>
<Tab title="API Key Rotation">
For [Datadog API Key Secret Rotation](/documentation/platform/secret-rotation/datadog-api-key), the token needs scopes to delete and read API Keys. Set `api_keys_delete` and `api_keys_write` under **API and Application Keys**.
</Tab>
</Tabs>
</Step>
<Step title="Copy the Application Key Value">
Copy the **Application Key** value and store it somewhere safe. You will need it when creating the Infisical connection.
</Step>
</Steps>
</Tab>
</Step>
<Step title="Select Datadog Connection">
Click the ** Add Connection** button and select **Datadog** from the list of available connections.
</Step>
<Step title="Fill out the Datadog Connection Modal">
Complete the Datadog Connection form by entering:
- A descriptive name for the connection
- An optional description for future reference
- The **Method** you want to use to authenticate (**Service Access Token**, recommended, or **Application Keys**)
- The Datadog **URL** for your region (e.g. `https://api.datadoghq.com`, `https://api.us5.datadoghq.com`, or `https://api.ddog-gov.com`)
- If using **Service Access Token**: the Datadog **Service Access Token**
- If using **Application Keys**: the **API Key** and the Service Account **Application Key** from the earlier steps
</Step>
<Step title="Connection Created">
After clicking Create, your **Datadog Connection** is established and ready to use with your Infisical project.
</Step>
</Steps>
</Tab>
<Tab title="API">
To create a Datadog Connection, make an API request to the [Create Datadog Connection](/api-reference/endpoints/app-connections/datadog/create) API endpoint.
### Sample request
<CodeGroup>
```bash Service Access Token (Recommended)
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/datadog \
--header 'Content-Type: application/json' \
--data '{
"name": "my-datadog-connection",
"method": "token",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"url": "https://api.datadoghq.com",
"token": "<YOUR-SERVICE-ACCESS-TOKEN>"
}
}'
```
```bash Application Keys
curl --request POST \
--url https://app.infisical.com/api/v1/app-connections/datadog \
--header 'Content-Type: application/json' \
--data '{
"name": "my-datadog-connection",
"method": "api-key",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"credentials": {
"url": "https://api.datadoghq.com",
"apiKey": "<YOUR-API-KEY>",
"applicationKey": "<YOUR-APPLICATION-KEY>"
}
}'
```
</CodeGroup>
### Sample response
```bash Response
{
"appConnection": {
"id": "e5d18aca-86f7-4026-a95e-efb8aeb0d8e6",
"name": "my-datadog-connection",
"projectId": "7ffbb072-2575-495a-b5b0-127f88caef78",
"description": null,
"version": 1,
"orgId": "6f03caa1-a5de-43ce-b127-95a145d3464c",
"createdAt": "2025-04-23T19:46:34.831Z",
"updatedAt": "2025-04-23T19:46:34.831Z",
"isPlatformManagedCredentials": false,
"credentialsHash": "7c2d371dec195f82a6a0d5b41c970a229cfcaf88e894a5b6395e2dbd0280661f",
"app": "datadog",
"method": "api-key",
"credentials": {
"url": "https://api.datadoghq.com"
}
}
}
```
</Tab>