Datadog uses two kinds of credentials, an API key and an application key. The API key lets a caller send metrics, logs and events into your account. The application key, used together with the API key, lets a caller read data and change configuration, depending on the scopes it was given. A leaked key can pollute your monitoring, run up your bill with junk data or, when paired with an application key, read your telemetry. Rotate first, then review.
Check your GitHub account for leaked secrets — free
- Provider
- Datadog
- Severity
- High
- Impact
- SaaS account access and billing
- Checked live by LeakWatch
- No
What a Datadog access token looks like
Datadog keys have no prefix and no readable marker. They are plain alphanumeric strings, and the rule targets the 40-character form:
…XXXX Datadog key (masked, 40 lowercase letters and digits, no prefix)
The 40-character length is the length of an application key; API keys are shorter, 32 characters. Because nothing in the value says Datadog, the name next to it does: DD_API_KEY, DD_APP_KEY, DATADOG_API_KEY, or a call to api.datadoghq.com or one of its regional variants. A bare 40-character string, which is also the length of a Git commit hash, cannot be attributed on its own.
How Datadog keys get leaked
- Agent configuration. A
datadog.yamlfile withapi_keyfilled in and committed with infrastructure code. - Container and Helm values. Keys written in plain text in a Kubernetes manifest, a Helm values file or a compose file.
- Terraform and CI. Provider blocks and pipeline files that carry both keys in plain text.
- Dashboards as code. Scripts that call the API to create monitors, with the keys typed in.
- Browser monitoring setups. A server-side key placed where only a client token belongs.
What to do in the first hour
- Find the key. In Datadog, open Organization Settings and the API Keys or Application Keys page. Each entry shows its name, the last characters, the creator and, for application keys, the owner.
- Create a replacement with a clear name, and an application key with the narrowest scopes your automation needs.
- Roll it out to agents, pipelines and integrations, and check that data keeps flowing.
- Revoke the exposed key from the list. Datadog stops accepting it, and an agent still using it will fail to report until updated.
- Check usage and the audit trail. Look at usage dashboards for a spike in custom metrics or log volume, and the audit trail for new monitors, changed notification channels, new users and new keys.
- Review the notification channels. Datadog integrations hold webhooks and tokens for chat and paging services. If the application key could edit them, rotate those at their own provider as well.
- Check the rest of the file. Monitoring configuration often sits next to cloud keys. See I accidentally pushed an API key to GitHub.
Not sure what else leaked from the same repository? Run a free scan.
Revoke it at Datadog
Datadog keys are revoked from the Organization Settings area of the Datadog site you use. Sign in with a role that can manage keys, open the API Keys or Application Keys page, and revoke the exposed one. Datadog runs several regional sites with different addresses, so open the one that matches the key’s region. Datadog’s documentation describes key management and scopes. The navigation can change, so look for the page where keys are created and listed if the labels differ.
How LeakWatch detects it
The rule is called Datadog Access Token. It is contextual: the word datadog must appear shortly before an assignment sign, followed by exactly 40 letters or digits. A key such as DD_API_KEY without the full word datadog close to it will not be matched, and an API key of 32 characters does not fit this rule. The severity is high. This type is not checked live: LeakWatch does not test the value against Datadog, so a finding means a matching string was seen, not that it still works.
LeakWatch detects this format but does not check it live: it can tell you the key is exposed, not whether it still works. Assume it does until you have revoked it.
FAQ
Can someone read my logs with a leaked API key alone?
The API key mainly lets a caller submit data. Reading data needs an application key with the right scopes, so check whether one leaked in the same place.
Why is my 32-character Datadog API key not reported?
This rule targets 40-character values. Rotate the API key anyway if it was exposed; the detection limit does not change the risk.
Is rotating the key enough?
Rotating stops new use. Also review the audit trail, because monitors or notification channels changed during the exposure remain after the key is gone.