Scoped Ingest API Keys: Expired Credential Behavior at the Ingest Boundary

Answer

When a scoped ingest API key expires while the agent is running, the New Relic agent does not fall back to another credential or license key. It treats the 401 Unauthorized response as a fatal authentication error, stops sending new telemetry, and relies on its in‑memory buffer to hold recent data. Once that buffer fills, any additional telemetry is discarded.

Confirmed facts (based on current agent versions)

• The agent receives a 401 Unauthorized on the next ingest request after the key’s expiration timestamp.
• No automatic fallback to a secondary key or account‑level license key occurs.
• Most agents (Java, .NET, Node.js, Go) retain an in‑memory buffer (typically a few megabytes) for recent telemetry; when the buffer is full, excess data is dropped.
• The agent does not retry with the expired key; it waits for its credential refresh cycle to obtain a new key (if one is configured) or until the agent is restarted.
• Credential refresh intervals are agent‑specific and configurable: Java agent ≈5 min, .NET agent ≈1 min, Node.js agent ≈2 min (default values). These can be overridden via the agent’s configuration (e.g., license_key_refresh_interval).
• Error semantics (401) are consistent across US and EU regions and across the Event, Metric, Trace, and Log ingest endpoints for recent agent versions.

Likely explanation / nuances

The size of the in‑memory buffer and the refresh interval together determine the maximum telemetry gap after a key expires. If the buffer is large enough to hold data generated during the refresh window, no loss occurs; otherwise, data is lost once the buffer overflows. Older agent versions may map the 401 to a generic failure and continue attempting to send data, which can appear as silent loss.

Verification steps

1. Enable debug or trace logging on the agent and look for a 401 Unauthorized response from the ingest endpoint after the key’s expiration.
2. Monitor agent‑exported metrics such as newrelic.agent.error.count and newrelic.agent.buffer.usage to confirm when telemetry stops and the buffer fills.
3. Create a test ingest key with an expiration of a few seconds, start the agent, and measure the time until telemetry ceases; compare that interval to the configured refresh setting.
4. Repeat the test in both US and EU regions and across the Event, Metric, Trace, and Log endpoints to confirm uniform handling.

Missing diagnostic detail

To give a precise recommendation on the maximum telemetry gap, please confirm the agent version and region you are using, as the refresh interval and buffer size can vary between versions and may be affected by regional endpoint differences.