Diag: Terraform provider 401/403, validate the key pair and api_url

TL;DR

Symptom (exact): terraform plan/apply fails with 401 Unauthorized or 403 Forbidden from the Datadog provider. Likely causes: (a) app key missing (API key alone is not enough), (b) api_url pointing at the wrong region, (c) app key lost permissions (owner role changed), (d) keys rotated.

Steps

1. Read the provider block: are api_key, app_key, AND api_url all set? The provider needs the trio; api_url must match your site (https://api.datadoghq.eu for EU, etc.).
2. Test outside Terraform: curl a simple GET (e.g. list monitors) with DD-API-KEY and DD-APPLICATION-KEY headers against the same api_url. 401 here means the keys, 200 means the provider config.
3. Check the app key owner: still active, still has the needed permissions? Some endpoints need extra access granted on the key.
4. Env var vs provider block: DD_API_KEY/DD_APP_KEY env vars work, but a provider block with stale values overrides them silently.
5. Fix: set the correct trio, prefer env vars from the secret manager in CI, and scope the app key to what Terraform manages.
6. Verify: the curl from step 2 returns 200, then terraform plan runs clean. Store the verification: a plan-only CI job catches the next rotation before apply time.

When to use

You are seeing this: Read the provider block: are api\key, app\key, AND api\url all set? Use this skill when you run into "Diag: Terraform provider 401/403, validate the key pair and apiurl".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://api.datadoghq.eu`

The Terraform docs and API reference use the DD-API-KEY and DD-APPLICATION-KEY header pair with a per-site api_url; the provider needs all three correct. Verified against live docs 2026-09-26.