How do I generate an API token for prometheus?

[begunfx]

The docs say that by default auth is required for the /metrics endpoint but say nothing about how to generate the token OR where I need to create and store it.

[scttbnsn]

There is no separate API token — the /metrics endpoint uses the same authentication you configure for the rest of drydock (Basic auth or OIDC).

Option 1: Disable metrics auth (simplest)

If your Prometheus instance is on a trusted network, you can skip auth on /metrics entirely:

environment:
  - DD_SERVER_METRICS_AUTH=false

Option 2: Use your Basic auth credentials

If you have Basic auth configured (DD_AUTH_BASIC_* env vars), use those same credentials in your Prometheus scrape config:

scrape_configs:
  - job_name: drydock
    basic_auth:
      username: john
      password: yourpassword   # the plain-text password (not the hash)
    static_configs:
      - targets: ["drydock:3000"]

The password here is the plain-text password that corresponds to the argon2id hash you set in DD_AUTH_BASIC_<name>_HASH. Prometheus sends it as a standard HTTP Basic Authorization header on each scrape.

I'll update the monitoring docs to make this clearer — you're right that this gap is confusing. Thanks for flagging it!

[scttbnsn]

Update: v1.5.0 adds dedicated bearer token auth for /metrics via DD_SERVER_METRICS_TOKEN.

Set the env var to any secret string and configure Prometheus with:

scrape_configs:
  - job_name: drydock
    bearer_token: your-secret-token
    static_configs:
      - targets: ["drydock:3000"]

This is the recommended approach for Prometheus scrapers — no session cookies or basic auth needed. The token is compared using SHA-256 + constant-time comparison.

Three auth modes for /metrics:

1. Bearer token (new, recommended) — set DD_SERVER_METRICS_TOKEN=<secret>
2. Basic auth (fallback) — use your Drydock login credentials
3. No auth — set DD_SERVER_METRICS_AUTH=false

[begunfx]

Don't forget to update the docs with this new addition!