Datadog API Keys: Lack of Automatic Expiration – Unresolved Least‑Privilege Rotation Decision

Answer

Datadog does not currently provide an automatic expiration or built‑in rotation workflow for organization API keys, and there is no public announcement indicating that such a feature is planned for upcoming releases.

Confirmed Facts

• API keys are long‑lived credentials that remain valid until explicitly revoked or deleted.
• The Datadog UI and API show no expiration field or policy setting for API keys.
• Least‑privilege access for API consumption is primarily achieved through application keys and RBAC/custom roles, not through key expiration.

Likely Explanation

Datadog treats the organization API key as an identifier for the account rather than a fine‑grained access token. Fine‑grained scoping is delegated to application keys and role‑based controls, so product‑level expiration is not seen as a substitute for those mechanisms.

Steps to Enforce Least‑Privilege Rotation (Operational Control)

1. Inventory all API keys: export creation date, last‑used timestamp, associated owner, and consuming services.
2. For each service that currently uses the organization API key, create a scoped application key with the minimum role required (e.g., metrics_write, logs ingest).
3. Store the new application key in a secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) and configure the service to retrieve it at startup or via a side‑car.
4. Deploy the updated service, verify that metrics, logs, traces, or API calls continue successfully.
5. After a short overlap period (only if consumers cannot reload credentials atomically), revoke the old organization API key via the Datadog API or UI.
6. Repeat on a fixed schedule (e.g., every 90 days) or immediately on owner change, security incident, or detection of unused keys.

Compliance Impact

The absence of native expiration does not automatically constitute non‑compliance, but auditors will expect evidence of:

• Inventory and classification of all API/application keys.
• Documented least‑privilege scoping (using application keys and RBAC).
• Periodic review and rotation procedures.
• Revocation logs and alerting for anomalous key usage.
• Retention of rotation records for the required audit period.

Implementing the operational controls above satisfies typical compensating‑control requirements for regulated environments.

Missing Diagnostic Detail

Before finalizing the rotation plan, confirm whether any of your integrations rely directly on the organization API key (rather than an application key). If they do, the rotation steps must include updating those integrations; otherwise, the plan can proceed as outlined.