Ingestion tokens

Your app authenticates to upzero's Collector with an ingestion token, not your own login. A token is scoped to one or more signal types, optionally to one service, and can carry an expiry. It is a separate credential from a dashboard API key: a token embedded in a running process needs independent revocation without touching anyone's account access, and a compromised token can only write telemetry, never read or write monitors or incidents.

Owner, Admin and Editor roles can create and revoke tokens. Viewer cannot.

Create a token

up0 tokens create --name prod-api --signals traces,logs,metrics \
  --service payments-api --expires-in 90d

--signals is a comma-separated subset of traces, logs, metrics (a request for a signal the token was not created with is rejected). --service is optional and, when set, restricts the token to one OTel service.name. --expires-in takes a duration like 90d, 1y, 24h, 30m; omit it for a token that does not expire.

Real output from a token created against a running stack (the secret is truncated, everything else is verbatim):

✓ Ingestion token "1641-docs-example" created.

  UP0_INGEST_TOKEN=up0_ing_IzAb…redacted…3DoB-_A2k          (shown once — store it now)
  Endpoint:        could not be resolved

The Endpoint: line is the one place a real ingestion host is ever printed, and only here, resolved from your own org's data_region. The walk above ran against a local dev cluster with no ingest domain configured, so it printed "could not be resolved" instead of a host; on a real deployment this line carries your endpoint. Copy that value once and use it everywhere these guides say <UPZERO_OTLP_ENDPOINT>. Nothing on this site prints that host itself (FR4); see the guide template for why.

If token creation is the first one for your org, the CLI offers to save it as the default in ~/.up0/config.yaml's ingestion.default_token, which is what lets a later up0 ingest test find it without a flag every time.

List tokens

up0 tokens list

                                                         Ingestion Tokens
┏━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━┓
┃ name              ┃ token_prefix     ┃ allowed_signals     ┃ service_name ┃ last_used_at ┃ expires_at                  ┃ status ┃
┡━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━┩
│ 1641-docs-example │ up0_ing_IzAb_pB8 │ traces,logs,metrics │ docs-example │ never        │ 2026-10-16T12:54:17.607445Z │ active │
└───────────────────┴──────────────────┴─────────────────────┴──────────────┴──────────────┴─────────────────────────────┴────────┘

token_prefix is enough to recognize a token in a log line; the full value is never shown again. status is derived as active, expired (past expires_at, not revoked) or revoked. --output json returns the same fields as structured JSON, for scripting.

up0 tokens list --output json

[{"id": "fc369152-…", "name": "1641-docs-example", "token_prefix": "up0_ing_IzAb_pB8", "allowed_signals": ["traces", "logs", "metrics"], "service_name": "docs-example", "revoked_at": null, "last_used_at": null, "expires_at": "2026-10-16T12:54:17.607445Z", "created_at": "2026-09-16T12:54:17.949829Z", "status": "active"}]

Revoke a token

up0 tokens revoke <token-id> --yes

Revocation is immediate across the whole Collector fleet, not on a per-node cache timeout. A revoked token stops working right away, not up to a minute later.

Rotation

There is no up0 tokens rotate command. Rotate by creating a new token, switching your app's configuration to it, confirming data with up0 ingest test, and then revoking the old one. Give the new token a longer --expires-in than the rollout will take, so a slow deploy does not race an expiry.