Dynatrace tokens

• Provider documentation Dynatrace docs "Token format" (updated 2026-08-04): three components separated by dots, a prefix that identifies the token type, a 24-character public portion and a 64-character secret portion; Dynatrace/dynatrace-operator pkg/util/dttoken/token.go (2a39d88, 2026-07-22): base32.StdEncoding truncated to each portion; re-checked 2026-09-29 · observed 2026-09-29 · dt0 + c|s + 2 digits + . + exactly 24 [A-Z2-7] + . + exactly 64 [A-Z2-7], 96 in all
• gitleaks 8.30.1
• Reference 1
• Reference 2
• Reference 3
• Reference 4
• Reference 5
• Reference 6
• Reference 7
• Reference 8
• Reference 9
• Reference 10

Arrival evidence (#528, product redact-secret#1032; #1014 handoff dynatrace.md, READY). Access and platform tokens authenticate the environment and account APIs; depending on scopes a token reads monitoring data (which can include payloads and logs), changes configuration, ingests data or manages the account. T1 for every fact: the docs state the structure, both lengths and the prefix table (dt0s01, dt0s02, dt0s03, dt0s04, dt0s06, dt0s08, dt0s09, dt0s16; dt0c01 by the docs request placeholder, R4), and the base32 alphabet is the provider generator (R1) and the docs example. The contract admits dt0 + c|s + any two digits, as the handoff decides. Excluded: the token identifier alone (safe to log), portions with lowercase or 0, 1, 8, 9 (never generated), other Dynatrace secrets in other shapes and the docs placeholder dt0c01.abc123.… (fails both widths). gitleaks 8.30.1 reads dt0c01 only and is case-insensitive over [a-z0-9], so it lags on every dt0s token and overreaches on lowercase and 0/1/8/9 twins; trufflehog 3.97.4 has no Dynatrace rule. Graduated to a registry detector at the 4fb7882 re-pin (redact-secret PR #1039).