From aff9d8d4ef3a26211569a40f756dcc7651a322be Mon Sep 17 00:00:00 2001 From: gnzjgo Date: Thu, 5 Feb 2026 23:18:58 +0100 Subject: [PATCH] fix: update token creation docs and use Authorization header - Replace deprecated tokens API (POST /v0/tokens/) with tb CLI command - Update scopes to WORKSPACE:READ_ALL and ORG_DATASOURCES:READ - Use Authorization header instead of token in query params for Datadog - Update both README.md and TEMPLATE.md Closes #42 Amp-Thread-ID: https://ampcode.com/threads/T-019c2fe0-1927-7498-8ef9-305a1df05e7e Co-authored-by: Amp --- README.md | 37 +++++++------------------------------ TEMPLATE.md | 20 +++++++------------- 2 files changed, 14 insertions(+), 43 deletions(-) diff --git a/README.md b/README.md index caa58e0..464cac4 100644 --- a/README.md +++ b/README.md @@ -38,19 +38,10 @@ tb --cloud deploy --template https://github.com/tinybirdco/tinybird-org-metrics- Access the Prometheus metrics endpoint at `https://api.tinybird.co/v0/pipes/organization_metrics.prometheus`. - Replace `api.tinybird.co` with your Tinybird host if the workspace is in a different region. See [Regions and endpoints](https://www.tinybird.co/docs/api-reference#regions-and-endpoints). -- **Token**: for a quick check in development, you can use the pre-existing *admin `user@domain` Token* of an Organization admin to authenticate requests. But for production, the creation of a *new token* with less permissions is recommended, including these scopes: -``` - PIPES:READ:organization_metrics - ORG_DATASOURCES:READ -``` -- As of this writing, the `ORG_DATASOURCES:READ` is not available from UI, but you can create this new **prometheus_org_access** token using tokens API like this: -```shell -POST https://api.tinybird.co/v0/tokens/?name=prometheus_org_access&description=optional&scope=PIPES:READ:organization_metrics&scope=ORG_DATASOURCES:READ -``` +- **Token**: for a quick check in development, you can use the pre-existing *admin `user@domain` Token* of an Organization admin to authenticate requests. But for production, create a dedicated token with minimal permissions using the [Tinybird CLI](https://www.tinybird.co/docs/forward/get-started/administration/tokens): -- If you want to access all pipes, you'll need to include additional scopes: -```shell -POST https://api.tinybird.co/v0/tokens/?name=prometheus_org_access&description=optional&scope=PIPES:READ:organization_metrics&scope=PIPES:READ:ingestion&scope=PIPES:READ:storage&scope=PIPES:READ:jobs&scope=PIPES:READ:requests&scope=ORG_DATASOURCES:READ +```bash +tb --cloud token create static prometheus_org_access --scope "WORKSPACE:READ_ALL" --scope "ORG_DATASOURCES:READ" ``` To scrape the Tinybird metrics endpoint, you can configure your `prometheus.yml` file as follows: @@ -64,24 +55,9 @@ scrape_configs: - targets: - 'api.tinybird.co' # Adjust this for your region if necessary metrics_path: '/v0/pipes/organization_metrics.prometheus' - bearer_token: '' # From an Organization admin -``` - -If you use a different setup, such as Datadog and OpenMetrics, you can use the following configuration: - -```yaml -instances: - - prometheus_url: https://api.tinybird.co/v0/pipes/organization_metrics.prometheus?token= - namespace: tinybird - metrics: - - "*" - tags: - - tinybird - max_returned_metrics: 10000 # Adjust this value as needed + bearer_token: '' ``` -Remember to replace `api.tinybird.co` with your Tinybird host if the Workspace is in a different region. See [Regions and endpoints](https://www.tinybird.co/docs/api-reference#regions-and-endpoints). - ### Grafana quick start We've included a sample dashboard config for Grafana to help you get started. See the [JSON file](grafana/tinybird_org_metrics.json). @@ -105,15 +81,16 @@ Add the following configuration to your OpenMetrics Datadog agent `conf.yaml` fi ```yaml instances: - - prometheus_url: 'https://api.tinybird.co/v0/pipes/organization_metrics.prometheus?token=' + - openmetrics_endpoint: 'https://api.tinybird.co/v0/pipes/organization_metrics.prometheus' namespace: tinybird_org_metrics + headers: + Authorization: 'Bearer ' metrics: - "*" max_returned_metrics: 700000 ``` - Replace `api.tinybird.co` with your Tinybird host if the workspace is in a different region. See [Regions and endpoints](https://www.tinybird.co/docs/api-reference#regions-and-endpoints). -- Use the `user@domain` admin token of an Organization admin to authenticate requests. We've included a sample dashboard config for Datadog that you can use to get started. See the [JSON file](datadog/tinybird_org_metrics.json). diff --git a/TEMPLATE.md b/TEMPLATE.md index 0e65b57..631f554 100644 --- a/TEMPLATE.md +++ b/TEMPLATE.md @@ -23,21 +23,14 @@ scrape_configs: - targets: - 'api.tinybird.co' # Adjust this for your region if necessary metrics_path: '/v0/pipes/organization_metrics.prometheus' - bearer_token: '' # From an Organization admin + bearer_token: '' ``` - Replace `api.tinybird.co` with your Tinybird host if the workspace is in a different region. See [Regions and endpoints](https://www.tinybird.co/docs/api-reference#regions-and-endpoints). -- **Token**: for a quick check in development, you can use the pre-existing *admin `user@domain` Token* of an Organization admin to authenticate requests (find it in the [Tinybird dashboard](https://app.tinybird.co/tokens)). But for production, the creation of a *new token* with less permissions is recommended, including these scopes: +- **Token**: for a quick check in development, you can use the pre-existing *admin `user@domain` Token* of an Organization admin to authenticate requests (find it in the [Tinybird dashboard](https://app.tinybird.co/tokens)). But for production, create a dedicated token with minimal permissions using the [Tinybird CLI](https://www.tinybird.co/docs/forward/get-started/administration/tokens): -``` - PIPES:READ:organization_metrics - ORG_DATASOURCES:READ -``` - -- As of this writing, the `ORG_DATASOURCES:READ` is not available from UI, but you can create this new **prometheus_org_access** token using tokens API like this: - -```shell -POST https://api.tinybird.co/v0/tokens/?name=prometheus_org_access&description=optional&scope=PIPES:READ:organization_metrics&scope=ORG_DATASOURCES:READ +```bash +tb --cloud token create static prometheus_org_access --scope "WORKSPACE:READ_ALL" --scope "ORG_DATASOURCES:READ" ``` We've included a sample dashboard config for Grafana to help you get started, see the [JSON file](https://github.com/tinybirdco/tinybird-org-metrics-exporter/blob/main/grafana/tinybird_org_metrics.json). @@ -48,14 +41,15 @@ Add the following configuration to your OpenMetrics Datadog agent `conf.yaml` fi ```yaml instances: - - prometheus_url: 'https://api.tinybird.co/v0/pipes/organization_metrics.prometheus?token=' + - openmetrics_endpoint: 'https://api.tinybird.co/v0/pipes/organization_metrics.prometheus' namespace: tinybird_org_metrics + headers: + Authorization: 'Bearer ' metrics: - "*" max_returned_metrics: 700000 ``` - Replace `api.tinybird.co` with your Tinybird host if the workspace is in a different region. See [Regions and endpoints](https://www.tinybird.co/docs/api-reference#regions-and-endpoints). -- Use `admin user@domain Token` of an Organization admin to authenticate requests. Find it in the [Tinybird dashboard](https://app.tinybird.co/tokens). We've included a sample dashboard config for Datadog that you can use to get started, see the [JSON file](https://github.com/tinybirdco/tinybird-org-metrics-exporter/blob/main/datadog/tinybird_org_metrics.json).