Menu

Caution

Grafana Alloy is the new name for our distribution of the OTel collector. Grafana Agent has been deprecated and is in Long-Term Support (LTS) through October 31, 2025. Grafana Agent will reach an End-of-Life (EOL) on November 1, 2025. Read more about why we recommend migrating to Grafana Alloy.

Important: This documentation is about an older version. It's relevant only to the release noted, many of the features and functions have been updated or replaced. Please view the current version.

Documentationbreadcrumb arrow Grafana Agentbreadcrumb arrow Flow modebreadcrumb arrow Referencebreadcrumb arrow Components referencebreadcrumb arrow otelcol.auth.oauth2
Open source

otelcol.auth.oauth2

otelcol.auth.oauth2 exposes a handler that can be used by other otelcol components to authenticate requests using OAuth 2.0.

The authorization tokens can be used by HTTP and gRPC based OpenTelemetry exporters. This component can fetch and refresh expired tokens automatically. For further details about OAuth 2.0 Client Credentials flow (2-legged workflow) see this document.

NOTE: otelcol.auth.oauth2 is a wrapper over the upstream OpenTelemetry Collector oauth2client extension. Bug reports or feature requests will be redirected to the upstream repository, if necessary.

Multiple otelcol.auth.oauth2 components can be specified by giving them different labels.

Usage

river 
otelcol.auth.oauth2 "LABEL" {
    client_id     = "CLIENT_ID"
    client_secret = "CLIENT_SECRET"
    token_url     = "TOKEN_URL"
}

Arguments

NameTypeDescriptionDefaultRequired
client_idstringThe client identifier issued to the client.yes
client_secretstringThe secret string associated with the client identifier.yes
token_urlstringThe server endpoint URL from which to get tokens.yes
endpoint_paramsmap(list(string))Additional parameters that are sent to the token endpoint.{}no
scopeslist(string)Requested permissions associated for the client.[]no
timeoutdurationThe timeout on the client connecting to token_url."0s"no

The timeout argument is used both for requesting initial tokens and for refreshing tokens. "0s" implies no timeout.

Blocks

The following blocks are supported inside the definition of otelcol.auth.oauth2:

HierarchyBlockDescriptionRequired
tlstlsTLS settings for the token client.no

tls block

The tls block configures TLS settings used for connecting to the token client. If the tls block isn’t provided, TLS won’t be used for communication.

The following arguments are supported:

NameTypeDescriptionDefaultRequired
ca_pemstringCA PEM-encoded text to validate the server with.no
ca_filestringPath to the CA file.no
cert_pemstringCertificate PEM-encoded text for client authentication.no
cert_filestringPath to the TLS certificate.no
key_pemsecretKey PEM-encoded text for client authentication.no
key_filestringPath to the TLS certificate key.no
min_versionstringMinimum acceptable TLS version for connections."TLS 1.2"no
max_versionstringMaximum acceptable TLS version for connections."TLS 1.3"no
reload_intervaldurationThe duration after which the certificate will be reloaded."0s"no
insecurebooleanDisables TLS when connecting to the configured server.no
insecure_skip_verifybooleanIgnores insecure server TLS certificates.no
server_namestringVerifies the hostname of server certificates when set.no

If the server doesn’t support TLS, the tls block must be provided with the insecure argument set to true. To disable tls for connections to the server, set the insecure argument to true.

If reload_interval is set to "0s", the certificate will never be reloaded.

The following pairs of arguments are mutually exclusive and cannot both be set simultaneously:

  • ca_pem and ca_file
  • cert_pem and cert_file
  • key_pem and key_file

Exported fields

The following fields are exported and can be referenced by other components:

NameTypeDescription
handlercapsule(otelcol.Handler)A value that other components can use to authenticate requests.

Component health

otelcol.auth.oauth2 is only reported as unhealthy if given an invalid configuration.

Debug information

otelcol.auth.oauth2 does not expose any component-specific debug information.

Example

This example configures otelcol.exporter.otlp to use OAuth 2.0 for authentication:

river 
otelcol.exporter.otlp "example" {
  client {
    endpoint = "my-otlp-grpc-server:4317"
    auth     = otelcol.auth.oauth2.creds.handler
  }
}

otelcol.auth.oauth2 "creds" {
    client_id     = "someclientid"
    client_secret = "someclientsecret"
    token_url     = "https://example.com/oauth2/default/v1/token"
}

Here is another example with some optional attributes specified:

river 
otelcol.exporter.otlp "example" {
  client {
    endpoint = "my-otlp-grpc-server:4317"
    auth     = otelcol.auth.oauth2.creds.handler
  }
}

otelcol.auth.oauth2 "creds" {
    client_id       = "someclientid2"
    client_secret   = "someclientsecret2"
    token_url       = "https://example.com/oauth2/default/v1/token"
    endpoint_params = {"audience" = ["someaudience"]}
    scopes          = ["api.metrics"]
    timeout         = "3600s"
}