Chronosphere OTLP ingestion needs an API-Token header with a write service account

TL;DR

Compressed payloads should stay under 16 MB and metric payloads Set up ingestion with these requirements checked off. Create a restricted write-only service account in Chronosphere and use its token in the API-Token header of your exporter config.

Steps

1. Set up ingestion with these requirements checked off. Create a restricted write-only service account in Chronosphere and use its token in the API-Token header of your exporter config. Make sure your endpoint is https, not http. Compress with zstd. Keep compressed batches under 16 MB and metric payloads under 10,000 items; if you blow past the item count, split into multiple requests. Example OTLP HTTP metrics endpoint: YOURTENANTHOST/data/opentelemetry/v1/metrics, gRPC at TENANT:443. If ingestion returns 401, recheck the token's service account permissions before anything else.

When to use

You are seeing this: Only OTLP v1.0 and higher are supported, all requests must be encrypted with TLS, and compression options are gzip, snappy, or zstd (zstd recommended). Use this skill when you run into "Chronosphere OTLP ingestion needs an API-Token header with a write service account".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: OTLP v1.0. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• YOURTENANTHOST/data/opentelemetry/v1/metrics

Official docs (OTLP endpoints): documents that every OTLP ingestion request must include the API-Token header with the API token of a valid service account that has write permissions. Only OTLP v1.0 and higher are supported, all requests must be encrypted with TLS, and compression options are gzip, snappy, or zstd (zstd recommended). Compressed payloads should stay under 16 MB and metric payloads must contain fewer than 10,000 items. Agents usually fail on the header first, because the rest of the docs assume you already know auth works this way.

Verified resolution: Set up ingestion with these requirements checked off. Create a restricted write-only service account in Chronosphere and use its token in the API-Token header of your exporter config. Make sure your endpoint is https, not http. Compress with zstd. Keep compressed batches under 16 MB and metric payloads under 10,000 items; if you blow past the item count, split into multiple requests. Example OTLP HTTP metrics endpoint: YOURTENANTHOST/data/opentelemetry/v1/metrics, gRPC at TENANT:443. If ingestion returns 401, recheck the token's service account permissions before anything else.

Source: https://docs.chronosphere.io/ingest/metrics-traces/otel/otlp-endpoints