Documentation Grafana Cloud Instrument and send data Grafana Alloy Reference Components otelcol otelcol.auth.oauth2

otelcol.auth.oauth2

otelcol.auth.oauth2 exposes a handler that other otelcol components can use to authenticate requests using OAuth 2.0.

This component only supports client authentication.

The authorization tokens can be used by HTTP and gRPC based OpenTelemetry exporters. This component can fetch and refresh expired tokens automatically. Refer to the OAuth 2.0 Authorization Framework for more information about the Auth 2.0 Client Credentials flow.

You can specify multiple otelcol.auth.oauth2 components by giving them different labels.

Usage

Alloy Copy

otelcol.auth.oauth2 "<LABEL>" {
    client_id     = "<CLIENT_ID>"
    client_secret = "<CLIENT_SECRET>"
    token_url     = "<TOKEN_URL>"
}

Arguments

You can use the following arguments with otelcol.auth.oauth2:

The timeout argument is used both for requesting initial tokens and for refreshing tokens. "0s" implies no timeout.

At least one of the client_id and client_id_file pair of arguments must be set. If both are set, client_id_file takes precedence.

If grant_type is client_credentials (default), at least one of client_secret or client_secret_file must be set. If both are set, client_secret_file takes precedence.

If grant_type is urn:ietf:params:oauth:grant-type:jwt-bearer, at least one of client_certificate_key or client_certificate_key_file must be set. If both are set, client_certificate_key_file takes precedence.

Blocks

You can use the following blocks with otelcol.auth.oauth2:

debug_metrics

tls

The tls block configures TLS settings used for connecting to the token client. If the tls block isn’t provided, TLS won’t be used for communication.

tpm

The tpm block configures retrieving the TLS key_file from a trusted device.

The following arguments are supported:

Expand table

Name	Type	Description	Default	Required
auth	string	The authorization value used to authenticate the TPM device.	""	no
enabled	bool	Load the tls.key_file from TPM.	false	no
owner_auth	string	The owner authorization value used to authenticate the TPM device.	""	no
path	string	Path to the TPM device or Unix domain socket.	""	no

The trusted platform module (TPM) configuration can be used for loading TLS key from TPM. Currently only TSS2 format is supported.

The path attribute is not supported on Windows.

In the following example, the private key my-tss2-key.key in TSS2 format is loaded from the TPM device /dev/tmprm0:

Alloy Copy

otelcol.example.component "<LABEL>" {
    ...
    tls {
        ...
        key_file = "my-tss2-key.key"
        tpm {
            enabled = true
            path = "/dev/tpmrm0"
        }
    }
}

Exported fields

The following fields are exported and can be referenced by other components:

Component health

otelcol.auth.oauth2 is only reported as unhealthy if given an invalid configuration.

Debug information

otelcol.auth.oauth2 doesn’t expose any component-specific debug information.

Example

This example configures otelcol.exporter.otlp to use OAuth 2.0 for authentication:

Alloy Copy

otelcol.exporter.otlp "example" {
  client {
    endpoint = "my-otlp-grpc-server:4317"
    auth     = otelcol.auth.oauth2.creds.handler
  }
}

otelcol.auth.oauth2 "creds" {
    client_id     = "someclientid"
    client_secret = "someclientsecret"
    token_url     = "https://example.com/oauth2/default/v1/token"
}

Here is another example with some optional attributes specified:

Alloy Copy

otelcol.exporter.otlp "example" {
  client {
    endpoint = "my-otlp-grpc-server:4317"
    auth     = otelcol.auth.oauth2.creds.handler
  }
}

otelcol.auth.oauth2 "creds" {
    client_id       = "someclientid2"
    client_secret   = "someclientsecret2"
    token_url       = "https://example.com/oauth2/default/v1/token"
    endpoint_params = {"audience" = ["someaudience"]}
    scopes          = ["api.metrics"]
    timeout         = "3600s"
}