Authdog accepts OpenTelemetry **OTLP/HTTP JSON** for traces, logs, and metrics. Point an SDK, the OpenTelemetry Collector, or Grafana Alloy at the Authdog API and authenticate with an environment API secret.

This page is the contract. A longer walkthrough with Collector YAML lives in [Set up OpenTelemetry with Authdog](/blog/setup-opentelemetry-with-authdog).

## Endpoints

Pick one base. Exporters append `/v1/traces`, `/v1/logs`, and `/v1/metrics` themselves.

| `OTEL_EXPORTER_OTLP_ENDPOINT` | Paths the exporter posts |
| --- | --- |
| `https://api.authdog.com` | `/v1/traces`, `/v1/logs`, `/v1/metrics` |
| `https://api.authdog.com/v1/otel` | `/v1/otel/v1/traces`, `/v1/otel/v1/logs`, `/v1/otel/v1/metrics` |

Self-hosted deployments use your API origin. The OpenAPI document at [`/v1/openapi`](https://api.authdog.com/v1/openapi) lists the same operations.

This path is **application telemetry**. Audit and security events still use [Events and webhooks](/docs/events-webhooks).

## Authenticate

Required environment variables:

```
OTEL_EXPORTER_OTLP_PROTOCOL=http/json
OTEL_EXPORTER_OTLP_HEADERS=Authorization=Bearer adenv_<environment-api-secret>
```

Mint the secret in the console: select the environment, then **Vault → API Keys** (`/dashboard/secrets?tab=api`). Copy it once. A `dev` secret cannot write into `prod`.

Tenant and environment come from the secret. Resource attributes such as `service.name` are stored but never used for tenancy.

## Protocol and limits

- **JSON only.** `application/x-protobuf` and gRPC return **415**.
- Gzip is fine when the runtime decompresses `Content-Encoding`.
- Body ≤ 2 MiB.
- ≤ 500 records per request. Overflow returns OTLP `partialSuccess`.
- Empty `{}` with HTTP 200 is full success.

## Related

- [Vault](/docs/vault): environment API secrets (`adenv_`)
- [Events and webhooks](/docs/events-webhooks): Authdog lifecycle events
- [Set up OpenTelemetry with Authdog](/blog/setup-opentelemetry-with-authdog): SDK and Collector examples