Scoped Ingest API Keys: Expired Credential Behavior at the Ingest Boundary

New Relic's move from account-level license keys to scoped ingest API keys changes how least-privilege telemetry ingest is designed. Ingest keys are write-only credentials that can be restricted by data type, while user API keys carry scopes for control-plane access. Both key types support optional expiration dates. This question assumes current agents and collectors that support scoped ingest keys.

The unresolved decision is what happens when an ingest key expires while an agent, forwarder, or collector is running. Expiration is enforced at authentication, but the client may not detect it until the next credential refresh cycle. The resulting behavior could be a fallback to a secondary credential, local buffering, or immediate discard of telemetry. That choice determines data-loss risk during rotation.

Behavior is expected to vary by New Relic region and by endpoint—Event, Metric, Trace, and Log APIs—and may differ between agent versions. Mixed license-key and ingest-key configurations can produce partial telemetry loss that is difficult to diagnose. Verification against a specific account region and agent version is required before relying on a rotation design.

• When an ingest key expires mid-run, does the agent fall back to another credential, buffer locally, or drop telemetry immediately?
• How do enforcement and error semantics differ across US and EU regions and across the Event, Metric, Trace, and Log API endpoints?
• What credential refresh interval determines the maximum telemetry gap after expiration, and does it vary by agent version?