Datadog API keys

• Provider documentation OpenAPI v1 ApiKey.key minLength/maxLength 32 and apiKeyAuth scheme · observed 2026-09-23 · Datadog's own API reference spec (docs.datadoghq.com /resources/json/full_spec_v1.json, v1 ApiKey schema, generated from DataDog/documentation hugo/data/api/v1/full_spec.yaml) fixes the API key value at exactly 32 characters (minLength 32, maxLength 32) and names the DD-API-KEY header and DD_API_KEY environment variable. The constraint is stated on the v1 key model; the v2 schema states no length. The lowercase-hex alphabet is not provider-stated: the spec's example fits it, and it is corroborated by Datadog-owned code and tools only
• trufflehog 3.97.4
• Reference 1

Re-tiered 2026-09-23 (#112, provider evidence redact-secret#644): the key has no prefix, so the provider-stated exact length plus the DD-API-KEY/DD_API_KEY marker is the whole identifying element, and the family stays context-gated (CONTEXT_GATED): a bare 32-character value with no same-line datadog/dd marker has no grammar of its own. Retained limitations: the 32/32 constraint sits on the v1 key model only (v2's FullAPIKeyAttributes.key states no length, though nothing suggests v1 and v2 issue different shapes); the provider states no character class, and Datadog-owned validators (Agent scrubber, privateactionrunner keys.go, dd-trace-java) accept uppercase A-F while datadog-ci's masking regex and every observed value are lowercase, so a hand-uppercased key would be outside the lowercase-hex shape the tools corroborate. The bare 32-character shape, gated on a same-line datadog/dd marker, is corroborated by TruffleHog's datadogapikey detector; the pinned gitleaks datadog-access-token rule instead matches a 40-character body (the application-key length), not this one. The provider-documented marker is a method-level twin limitation: a context twin is reserved for policy-tier contracts, so only the length dimension carries a twin.