Skip to content

Use JWTs with sync-cli #434

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
michael-richey merged 4 commits into from
Jan 13, 2026
Merged

Use JWTs with sync-cli #434

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
2b8fe44
Use JWTs with sync-cli
michael-richey Jan 12, 2026
025d9e7
Remove unused constant
michael-richey Jan 13, 2026
e7ff14c
Adding a warning message if both were provided
michael-richey Jan 13, 2026
4be4281
Updated message to explain what's actually going to happen
michael-richey Jan 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions datadog_sync/commands/shared/options.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,6 +42,13 @@ def handle_parse_result(self, ctx: Context, opts: Dict[Any, Any], args: List[Any
help="Datadog source organization APP key.",
cls=CustomOptionClass,
),
option(
"--source-jwt",
envvar=constants.DD_SOURCE_JWT,
required=False,
help="Datadog source organization JWT (takes precedence over API key).",
cls=CustomOptionClass,
),
option(
"--source-api-url",
envvar=constants.DD_SOURCE_API_URL,
Expand All @@ -68,6 +75,13 @@ def handle_parse_result(self, ctx: Context, opts: Dict[Any, Any], args: List[Any
help="Datadog destination organization APP key.",
cls=CustomOptionClass,
),
option(
"--destination-jwt",
envvar=constants.DD_DESTINATION_JWT,
required=False,
help="Datadog destination organization JWT (takes precedence over API key).",
cls=CustomOptionClass,
),
option(
"--destination-api-url",
envvar=constants.DD_DESTINATION_API_URL,
Expand Down
2 changes: 2 additions & 0 deletions datadog_sync/constants.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,11 @@
DD_SOURCE_API_URL = "DD_SOURCE_API_URL"
DD_SOURCE_API_KEY = "DD_SOURCE_API_KEY"
DD_SOURCE_APP_KEY = "DD_SOURCE_APP_KEY"
DD_SOURCE_JWT = "DD_SOURCE_JWT"
DD_DESTINATION_API_URL = "DD_DESTINATION_API_URL"
DD_DESTINATION_API_KEY = "DD_DESTINATION_API_KEY"
DD_DESTINATION_APP_KEY = "DD_DESTINATION_APP_KEY"
DD_DESTINATION_JWT = "DD_DESTINATION_JWT"
DD_HTTP_CLIENT_RETRY_TIMEOUT = "DD_HTTP_CLIENT_RETRY_TIMEOUT"
DD_HTTP_CLIENT_TIMEOUT = "DD_HTTP_CLIENT_TIMEOUT"
DD_RESOURCES = "DD_RESOURCES"
Expand Down
24 changes: 18 additions & 6 deletions datadog_sync/utils/configuration.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,18 +144,30 @@ def build_config(cmd: Command, **kwargs: Optional[Any]) -> Configuration:
send_metrics = kwargs.get("send_metrics")
verify_ssl = kwargs.get("verify_ssl_certificates", True)

# JWT takes precedence over API keys, so warn if user provided both
if (kwargs.get("source_jwt") and kwargs.get("source_api_key")) or (
kwargs.get("destination_jwt") and kwargs.get("destination_api_key")
):
logger.warning("Both a JWT and an API key were found, the JWT will take precedence.")

source_auth = {}
if k := kwargs.get("source_api_key"):
# JWT takes precedence over API keys
if jwt := kwargs.get("source_jwt"):
source_auth["jwtAuth"] = jwt
elif k := kwargs.get("source_api_key"):
source_auth["apiKeyAuth"] = k
if k := kwargs.get("source_app_key"):
source_auth["appKeyAuth"] = k
if k := kwargs.get("source_app_key"):
source_auth["appKeyAuth"] = k
source_client = CustomClient(source_api_url, source_auth, retry_timeout, timeout, send_metrics, verify_ssl)

destination_auth = {}
if k := kwargs.get("destination_api_key"):
# JWT takes precedence over API keys
Copy link
Collaborator

@heyronhay heyronhay Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we output a message somewhere if JWT and API keys are specified that the JWT overrides it?

Copy link
Collaborator Author

@michael-richey michael-richey Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good idea, added on lines 147-152.

if jwt := kwargs.get("destination_jwt"):
destination_auth["jwtAuth"] = jwt
elif k := kwargs.get("destination_api_key"):
destination_auth["apiKeyAuth"] = k
if k := kwargs.get("destination_app_key"):
destination_auth["appKeyAuth"] = k
if k := kwargs.get("destination_app_key"):
destination_auth["appKeyAuth"] = k
destination_client = CustomClient(
destination_api_url,
destination_auth,
Expand Down
10 changes: 8 additions & 2 deletions datadog_sync/utils/custom_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -291,11 +291,17 @@ async def get_ddr_status(self) -> Dict:

def build_default_headers(auth_obj: Dict[str, str]) -> Dict[str, str]:
headers = {
"DD-API-KEY": auth_obj.get("apiKeyAuth", ""),
"DD-APPLICATION-KEY": auth_obj.get("appKeyAuth", ""),
"Content-Type": "application/json",
"User-Agent": _get_user_agent(),
}

# JWT takes precedence over API keys
if jwt := auth_obj.get("jwtAuth"):
headers["dd-auth-jwt"] = jwt
else:
headers["DD-API-KEY"] = auth_obj.get("apiKeyAuth", "")
headers["DD-APPLICATION-KEY"] = auth_obj.get("appKeyAuth", "")

return headers


Expand Down