Enable dashboard telemetry API by default with ApiKey auth and login token exchange by JamesNK · Pull Request #16326 · microsoft/aspire

JamesNK · 2026-04-20T05:48:52Z

Description

Improve the standalone dashboard experience for aspire otel commands by enabling the telemetry API by default with API key authentication, and adding automatic authentication via login token exchange.

Dashboard API defaults

Default Api.Enabled to true — The dashboard API is now enabled by default. Previously it defaulted to disabled unless explicitly configured.
Default Api.AuthMode to ApiKey — The API authentication mode now defaults to ApiKey instead of being conditional on whether a key was provided.
Auto-generate API key — When AuthMode is ApiKey but no PrimaryApiKey is specified, a 128-bit key is auto-generated (matching the existing BrowserToken pattern in PostConfigureDashboardOptions).
Add Api.Disabled property — New Disabled property on ApiOptions. Api.Enabled is marked [Obsolete] and delegates to Disabled via a shared backing field. Setting either property updates the other.
Add ASPIRE_DASHBOARD_API_DISABLED / Dashboard:Api:Disabled config — New config names (DashboardAspireApiDisabledName, DashboardApiDisabledName). DashboardAspireApiDisabledName takes precedence over DashboardAspireApiEnabledName in PostConfigureDashboardOptions.

CLI changes

Enable telemetry API by default in aspire dashboard run — Removed the --enable-api option. The API is now always enabled unless explicitly overridden via unmatched tokens or environment variable.
Auto-exchange login token for API key — When a user passes a login URL (e.g. http://localhost:18888/login?t=abc123) to --dashboard-url, the CLI automatically extracts the browser token from the t query parameter and exchanges it for an API key via the POST /api/telemetry/validateToken endpoint. Users can copy-paste the login URL from dashboard output and aspire otel logs just works.
Improved error messages — Better error messages in telemetry commands when the dashboard API is not enabled or authentication fails. The DashboardApiNotEnabled message now suggests the CLI command alongside the raw config key.
Error handling fix — In TelemetryLogsCommand and TelemetrySpansCommand, the initial /api/telemetry/resources call was outside the HttpRequestException try/catch block. When the API was disabled, the 404 surfaced as a raw exception. Moved the try/catch to wrap the entire fetch method body.

Dashboard endpoint

Add POST /api/telemetry/validateToken — New endpoint that accepts a frontend browser token and returns the telemetry API key (or null if unsecured). Uses constant-time comparison via CompareHelpers.CompareKey. Returns 401 for invalid tokens.

Other

Login URL normalization — --dashboard-url strips /login path and query string automatically.
localhive scripts — Clean stale managed publish output before rebuilding.

Fixes #16236

Checklist

Is this feature complete?
- Yes. Ready to ship.
- No. Follow-up changes expected.
Are you including unit tests for the changes and scenario tests if relevant?
- Yes
- No
Did you add public API?
- Yes
  - ApiOptions.Disabled property (new)
  - ApiOptions.Enabled marked [Obsolete]
- No
Does the change make any security assumptions or guarantees?
- Yes
  - If yes, have you done a threat model and had a security review?
    - Yes
    - No
  - The validateToken endpoint validates the browser token before returning the API key. It uses CompareHelpers.CompareKey (constant-time comparison) and requires the frontend auth mode to be BrowserToken. The endpoint is scoped under /api/telemetry and returns 401 for invalid tokens. API keys are auto-generated using RandomNumberGenerator with 128-bit entropy.
- No
Does the change require an update in our Aspire docs?
- Yes
- No

- Move try/catch in TelemetryLogsCommand and TelemetrySpansCommand to wrap GetAllResourcesAsync, so 404 from /api/telemetry/resources is caught and produces a user-friendly error instead of a raw exception - Normalize login URLs passed to --dashboard-url (strip /login?t=... path) - Update DashboardApiNotEnabled message to suggest 'aspire dashboard run --enable-api' - Improve --dashboard-url option description to clarify it accepts login URLs - Add tests for resources-endpoint-404 and login URL normalization scenarios Fixes #16236

github-actions · 2026-04-20T05:49:05Z

🚀 Dogfood this PR with:

⚠️ WARNING: Do not do this without first carefully reviewing the code of this PR to satisfy yourself it is safe.

curl -fsSL https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.sh | bash -s -- 16326

Or

Run remotely in PowerShell:

iex "& { $(irm https://raw.githubusercontent.com/microsoft/aspire/main/eng/scripts/get-aspire-cli-pr.ps1) } 16326"

- Remove --enable-api option from 'aspire dashboard run'; API is now always enabled - Add POST /api/telemetry/validateToken endpoint to exchange browser login token for API key - Update CLI telemetry commands to auto-extract login token from dashboard URL and exchange it for an API key - Add ExtractLoginToken helper to parse login URLs - Add source-generated JSON context for camelCase serialization - Add tests for token exchange, login token extraction, and updated dashboard run defaults

Auto-generate an API key and set DASHBOARD__API__PRIMARYAPIKEY and DASHBOARD__API__AUTHMODE=ApiKey via environment variables (not CLI args) when launching the standalone dashboard. This ensures the telemetry API requires authentication by default, matching the Hosting project pattern. Skipped when --allow-anonymous is set or when the user provides their own API key via unmatched tokens/env vars.

…sage, update xlf files

…ard-url-ux

…ange - Fix connection-refused showing wrong error (DashboardLoginTokenFailed instead of DashboardConnectionFailed) - Refactor validateToken endpoints to use JSON request/response bodies with shared types - Split error messages into error (what went wrong) + hints (how to fix) + log path - Add TelemetryErrorInfo record supporting multiple hints - Mention --allow-anonymous and ASPIRE_DASHBOARD_UNSECURED_ALLOW_ANONYMOUS in auth/token errors - Move shared TelemetryValidateTokenRequest/Response to src/Shared for AOT-compatible serialization

- Default Api.Enabled to true (API is on by default) - Default Api.AuthMode to ApiKey (was conditional on key presence) - Auto-generate API key when AuthMode is ApiKey but no key specified - Add Api.Disabled property, mark Api.Enabled as obsolete - Add ASPIRE_DASHBOARD_API_DISABLED / Dashboard:Api:Disabled config - DashboardAspireApiDisabledName takes precedence over Enabled - Update all consumers to use Api.Disabled instead of Api.Enabled - Combine ApiEnabled/ApiDisabled tests into parameterized theory

Copilot

Pull request overview

Enables the Aspire Dashboard telemetry HTTP API by default (secured via API key) to improve the standalone aspire otel experience, including automatic auth when users paste a dashboard login URL.

Changes:

Dashboard: default-enable telemetry API with ApiKey auth, auto-generate API key, and introduce Api.Disabled (with Enabled obsolete + new config keys).
CLI: remove --enable-api, accept/normalize /login?t=... URLs, auto-exchange login token for an API key, and improve telemetry error presentation.
Add POST /api/telemetry/validateToken endpoint + shared DTOs, plus broadened integration/unit test coverage and updated localized strings.

Reviewed changes

Copilot reviewed 50 out of 51 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/Aspire.Dashboard.Tests/Integration/TelemetryApiTests.cs	Adjusts integration assertions for new API auth defaults and key auto-generation.
tests/Aspire.Dashboard.Tests/Integration/StartupTests.cs	Expands API enabled/disabled coverage and warning expectations.
tests/Aspire.Dashboard.Tests/Integration/IntegrationTestHelpers.cs	Updates default test configuration to include API auth mode.
tests/Aspire.Cli.Tests/Mcp/McpToolHelpersTests.cs	Adds coverage for extracting login tokens from dashboard login URLs.
tests/Aspire.Cli.Tests/Mcp/ListStructuredLogsToolTests.cs	Aligns MCP error assertions with new error message keys.
tests/Aspire.Cli.Tests/Commands/TelemetrySpansCommandTests.cs	Adds CLI test for “API not enabled” 404 handling.
tests/Aspire.Cli.Tests/Commands/TelemetryLogsCommandTests.cs	Adds CLI tests for login URL normalization and improved 404/connection handling.
tests/Aspire.Cli.Tests/Commands/TelemetryCommandTests.cs	Adds tests for token exchange behavior and request/URL correctness.
tests/Aspire.Cli.Tests/Commands/DashboardRunCommandTests.cs	Updates expectations for API being enabled by default and env-var key injection.
src/Shared/Otlp/Serialization/OtlpJsonSerializerContext.cs	Registers new validate-token request/response types for source-gen JSON.
src/Shared/Model/Serialization/TelemetryValidateTokenJson.cs	Adds shared request/response DTOs for `/api/telemetry/validateToken`.
src/Shared/KnownConfigNames.cs	Introduces `ASPIRE_DASHBOARD_API_DISABLED` known config name.
src/Shared/DashboardUrls.cs	Adds helper for building the validate-token exchange endpoint URL.
src/Shared/DashboardConfigNames.cs	Adds config name constants for `Dashboard:Api:Disabled` and Aspire env var mapping.
src/Aspire.Dashboard/Telemetry/DashboardTelemetrySender.cs	Lowers “telemetry not configured” log to Debug.
src/Aspire.Dashboard/Properties/launchSettings.json	Adds a launch profile exercising browser + API key configuration.
src/Aspire.Dashboard/Model/Assistant/ChatClientFactory.cs	Lowers AI enable/disable logs to Debug.
src/Aspire.Dashboard/DashboardWebApplication.cs	Switches enabled checks to `Api.Disabled` and adds debug visibility.
src/Aspire.Dashboard/DashboardEndpointsBuilder.cs	Adds `/api/telemetry/validateToken` and supports POST-notfound when API disabled.
src/Aspire.Dashboard/Configuration/ValidateDashboardOptions.cs	Updates validation assumptions around API key generation defaults.
src/Aspire.Dashboard/Configuration/PostConfigureDashboardOptions.cs	Implements default auth mode, API key auto-generation, and disabled/enabled precedence.
src/Aspire.Dashboard/Configuration/DashboardOptions.cs	Adds `ApiOptions.Disabled` + obsoletes `Enabled` with shared backing field.
src/Aspire.Dashboard/Components/Pages/Login.razor.js	Updates browser-token validation call to JSON-body POST.
src/Aspire.Dashboard/Components/Layout/MainLayout.razor.cs	Switches API warning logic to `Api.Disabled`.
src/Aspire.Dashboard/Aspire.Dashboard.csproj	Links the shared validate-token DTO file into Dashboard build.
src/Aspire.Dashboard/Api/ApiAuthenticationHandler.cs	Tightens API auth to require API key (or allow unsecured), removing frontend fallback behavior.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.zh-Hant.xlf	Updates telemetry error strings and adds hint strings.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.zh-Hans.xlf	Updates telemetry error strings and adds hint strings.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.tr.xlf	Updates telemetry error strings and adds hint strings.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.ru.xlf	Updates telemetry error strings and adds hint strings.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.pt-BR.xlf	Updates telemetry error strings and adds hint strings.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.pl.xlf	Updates telemetry error strings and adds hint strings.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.ko.xlf	Updates telemetry error strings and adds hint strings.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.ja.xlf	Updates telemetry error strings and adds hint strings.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.it.xlf	Updates telemetry error strings and adds hint strings.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.fr.xlf	Updates telemetry error strings and adds hint strings.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.es.xlf	Updates telemetry error strings and adds hint strings.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.de.xlf	Updates telemetry error strings and adds hint strings.
src/Aspire.Cli/Resources/xlf/TelemetryCommandStrings.cs.xlf	Updates telemetry error strings and adds hint strings.
src/Aspire.Cli/Resources/TelemetryCommandStrings.resx	Adds structured error + hint strings and updates option description text.
src/Aspire.Cli/Resources/TelemetryCommandStrings.Designer.cs	Regenerates designer accessors for new/renamed resource keys.
src/Aspire.Cli/Mcp/Tools/McpToolHelpers.cs	Adds login-token extraction helper from dashboard login URLs.
src/Aspire.Cli/Commands/TelemetryTracesCommand.cs	Switches to structured telemetry error reporting and updated API discovery signature.
src/Aspire.Cli/Commands/TelemetrySpansCommand.cs	Wraps the full fetch path in error handling and switches to structured errors.
src/Aspire.Cli/Commands/TelemetryLogsCommand.cs	Wraps the full fetch path in error handling and switches to structured errors.
src/Aspire.Cli/Commands/TelemetryCommandHelpers.cs	Adds login-token exchange, URL normalization, and structured error+hint plumbing.
src/Aspire.Cli/Commands/ExportCommand.cs	Updates dashboard API discovery signature and uses structured error display.
src/Aspire.Cli/Commands/DashboardRunCommand.cs	Removes `--enable-api`, always enables API by default, and injects env-var secrets safely.
src/Aspire.Cli/Aspire.Cli.csproj	Links shared DashboardConfigNames + validate-token DTO into CLI build.
localhive.sh	Cleans stale managed publish output before bundling to avoid incremental publish skipping.
localhive.ps1	Cleans stale managed publish output before bundling to avoid incremental publish skipping.

Files not reviewed (1)

src/Aspire.Cli/Resources/TelemetryCommandStrings.Designer.cs: Language not supported

…uthMode env var - Update ApiAuthenticationHandler XML docs to reflect removal of frontend auth fallback - Remove dead EnableApiOptionDescription resource from resx, Designer.cs, and xlf files - Guard DashboardApiAuthModeName env var with ConfigSettingHasValue check

- Remove async from HandleAuthenticateAsync (no awaits remain after frontend fallback removal) - Replace bool ConnectionFailed with TokenExchangeFailureKind enum to distinguish 404/401/connection errors - Surface DashboardApiNotEnabled error when token exchange returns 404 (API disabled) - Check ASPIRE_DASHBOARD_API_DISABLED in addition to API_ENABLED before injecting default

The /api/validatetoken endpoint was changed to accept [FromBody] ValidateTokenRequest but the test was still sending the token as a query parameter.

adamint · 2026-04-20T17:37:36Z

-  <data name="DashboardApiNotAvailable" xml:space="preserve">
-    <value>Dashboard API is not available. Ensure the AppHost is running with Dashboard enabled.</value>
+  <data name="DashboardNotAvailable" xml:space="preserve">
+    <value>Could not fetch telemetry data from the dashboard. The dashboard is not available.</value>


Suggested change

<value>Could not fetch telemetry data from the dashboard. The dashboard is not available.</value>

<value>Could not fetch telemetry data from the dashboard: the dashboard is not available.</value>

I'm not sure about this format. I applied all changes except these.

adamint · 2026-04-20T17:38:05Z

  </data>
  <data name="DashboardUrlOptionDescription" xml:space="preserve">
-    <value>URL of a standalone Aspire Dashboard to connect to directly (bypasses AppHost discovery)</value>
+    <value>Base URL of a standalone Aspire Dashboard (e.g. http://localhost:18888). Login URLs are also accepted and automatically normalized</value>


Suggested change

<value>Base URL of a standalone Aspire Dashboard (e.g. http://localhost:18888). Login URLs are also accepted and automatically normalized</value>

<value>Base URL of a standalone Aspire Dashboard (e.g. http://localhost:18888). Login URLs are also accepted and automatically normalized.</value>

adamint · 2026-04-20T17:38:50Z

  </data>
  <data name="DashboardAuthFailed" xml:space="preserve">
-    <value>Authentication denied by the dashboard. Use --api-key to specify a valid API key that matches the dashboard's configured API key (Dashboard:Api:PrimaryApiKey).</value>
+    <value>Could not fetch telemetry data from the dashboard. Authentication was denied.</value>


Suggested change

<value>Could not fetch telemetry data from the dashboard. Authentication was denied.</value>

<value>Could not fetch telemetry data from the dashboard: authentication failed.</value>

adamint · 2026-04-20T17:41:45Z

+    <value>Could not fetch telemetry data from the dashboard. Authentication was denied.</value>
+  </data>
+  <data name="DashboardAuthFailedHint" xml:space="preserve">
+    <value>Authenticate with the dashboard using a --dashboard-url value that includes a valid login token (e.g. http://localhost:18888/login?t=TOKEN), or specify --api-key with a key matching the dashboard's configured API key.</value>


Suggested change

<value>Authenticate with the dashboard using a --dashboard-url value that includes a valid login token (e.g. http://localhost:18888/login?t=TOKEN), or specify --api-key with a key matching the dashboard's configured API key.</value>

<value>Authenticate with the dashboard either with a --dashboard-url including a valid login token (e.g. http://localhost:18888/login?t=TOKEN), or with an --api-key matching the dashboard's configured API key.</value>

adamint · 2026-04-20T17:42:29Z

+                // Parse query string to find 't' parameter
+                var queryParams = HttpUtility.ParseQueryString(query);
+                var token = queryParams["t"];
+                if (!string.IsNullOrEmpty(token))


this check is redundant

adamint

Automated review: found 1 configuration issue.

- Fix DashboardUrlOptionDescription missing trailing period - Change DashboardAuthFailed from 'denied' to 'failed' - Simplify DashboardAuthFailedHint wording - Remove redundant query.Length check in McpToolHelpers.ExtractLoginToken - Update xlf translation files

github-actions · 2026-04-21T03:31:25Z

🎬 CLI E2E Test Recordings — 72 recordings uploaded (commit 659fd48)

View recordings

Test	Recording
AddPackageInteractiveWhileAppHostRunningDetached	▶️ View Recording
AddPackageWhileAppHostRunningDetached	▶️ View Recording
AgentCommands_AllHelpOutputs_AreCorrect	▶️ View Recording
AgentInitCommand_DefaultSelection_InstallsSkillOnly	▶️ View Recording
AgentInitCommand_MigratesDeprecatedConfig	▶️ View Recording
AspireAddPackageVersionToDirectoryPackagesProps	▶️ View Recording
AspireUpdateRemovesAppHostPackageVersionFromDirectoryPackagesProps	▶️ View Recording
Banner_DisplayedOnFirstRun	▶️ View Recording
Banner_DisplayedWithExplicitFlag	▶️ View Recording
Banner_NotDisplayedWithNoLogoFlag	▶️ View Recording
CertificatesClean_RemovesCertificates	▶️ View Recording
CertificatesTrust_WithNoCert_CreatesAndTrustsCertificate	▶️ View Recording
CertificatesTrust_WithUntrustedCert_TrustsCertificate	▶️ View Recording
ConfigSetGet_CreatesNestedJsonFormat	▶️ View Recording
CreateAndRunAspireStarterProject	▶️ View Recording
CreateAndRunAspireStarterProjectWithBundle	▶️ View Recording
CreateAndRunEmptyAppHostProject	▶️ View Recording
CreateAndRunJavaEmptyAppHostProject	▶️ View Recording
CreateAndRunJsReactProject	▶️ View Recording
CreateAndRunPythonReactProject	▶️ View Recording
CreateAndRunTypeScriptEmptyAppHostProject	▶️ View Recording
CreateAndRunTypeScriptStarterProject	▶️ View Recording
CreateJavaAppHostWithViteApp	▶️ View Recording
CreateTypeScriptAppHostWithViteApp	▶️ View Recording
DashboardRunWithOtelTracesReturnsNoTraces	▶️ View Recording
DeployK8sBasicApiService	▶️ View Recording
DeployK8sWithGarnet	▶️ View Recording
DeployK8sWithMongoDB	▶️ View Recording
DeployK8sWithMySql	▶️ View Recording
DeployK8sWithPostgres	▶️ View Recording
DeployK8sWithRabbitMQ	▶️ View Recording
DeployK8sWithRedis	▶️ View Recording
DeployK8sWithSqlServer	▶️ View Recording
DeployK8sWithValkey	▶️ View Recording
DeployTypeScriptAppToKubernetes	▶️ View Recording
DescribeCommandResolvesReplicaNames	▶️ View Recording
DescribeCommandShowsRunningResources	▶️ View Recording
DetachFormatJsonProducesValidJson	▶️ View Recording
DetachFormatJsonProducesValidJsonWhenRestartingExistingInstance	▶️ View Recording
DoListStepsShowsPipelineSteps	▶️ View Recording
DoctorCommand_DetectsDeprecatedAgentConfig	▶️ View Recording
DoctorCommand_WithSslCertDir_ShowsTrusted	▶️ View Recording
DoctorCommand_WithoutSslCertDir_ShowsPartiallyTrusted	▶️ View Recording
GlobalMigration_HandlesCommentsAndTrailingCommas	▶️ View Recording
GlobalMigration_HandlesMalformedLegacyJson	▶️ View Recording
GlobalMigration_PreservesAllValueTypes	▶️ View Recording
GlobalMigration_SkipsWhenNewConfigExists	▶️ View Recording
GlobalSettings_MigratedFromLegacyFormat	▶️ View Recording
InitTypeScriptAppHost_AugmentsExistingViteRepoAtRoot	▶️ View Recording
InvalidAppHostPathWithComments_IsHealedOnRun	▶️ View Recording
LegacySettingsMigration_AdjustsRelativeAppHostPath	▶️ View Recording
LogsCommandShowsResourceLogs	▶️ View Recording
OtelLogsReturnsStructuredLogsFromStarterApp	▶️ View Recording
PsCommandListsRunningAppHost	▶️ View Recording
PsFormatJsonOutputsOnlyJsonToStdout	▶️ View Recording
PublishWithConfigureEnvFileUpdatesEnvOutput	▶️ View Recording
PublishWithDockerComposeServiceCallbackSucceeds	▶️ View Recording
PublishWithoutOutputPathUsesAppHostDirectoryDefault	▶️ View Recording
RestoreGeneratesSdkFiles	▶️ View Recording
RestoreRefreshesGeneratedSdkAfterAddingIntegration	▶️ View Recording
RestoreSupportsConfigOnlyHelperPackageAndCrossPackageTypes	▶️ View Recording
RunFromParentDirectory_UsesExistingConfigNearAppHost	▶️ View Recording
SecretCrudOnDotNetAppHost	▶️ View Recording
SecretCrudOnTypeScriptAppHost	▶️ View Recording
StagingChannel_ConfigureAndVerifySettings_ThenSwitchChannels	▶️ View Recording
StartAndWaitForTypeScriptSqlServerAppHostWithNativeAssets	▶️ View Recording
StopAllAppHostsFromAppHostDirectory	▶️ View Recording
StopAllAppHostsFromUnrelatedDirectory	▶️ View Recording
StopNonInteractiveMultipleAppHostsShowsError	▶️ View Recording
StopNonInteractiveSingleAppHost	▶️ View Recording
StopWithNoRunningAppHostExitsSuccessfully	▶️ View Recording
UnAwaitedChainsCompileWithAutoResolvePromises	▶️ View Recording

_{📹 Recordings uploaded automatically from CI run #24701868889}

- Dashboard:Api:Enabled now defaults to true (API enabled by default) - Dashboard:Api:AuthMode now defaults to ApiKey - Add Dashboard:Api:Disabled as the new preferred config to disable the API - Mark Dashboard:Api:Enabled as deprecated in docs - Update PrimaryApiKey default to note auto-generation - Add --dashboard-url and --api-key options to aspire otel logs/spans/traces - Document login URL support: passing http://host/login?t=<token> auto-exchanges the token for an API key - Update aspire otel main page description to mention standalone dashboard usage Documents changes from microsoft/aspire#16326 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

aspire-repo-bot · 2026-04-21T03:38:33Z

Pull request created: #732

Generated by PR Documentation Check

aspire-repo-bot · 2026-04-21T03:38:35Z

📝 Documentation draft PR created on microsoft/aspire.dev

The following documentation updates have been drafted to cover the user-facing changes in this PR:

Changes included

dashboard/configuration.mdx — Updated the API configuration section:

Dashboard:Api:Enabled default updated from false → true; marked as deprecated
New Dashboard:Api:Disabled config option documented (also as ASPIRE_DASHBOARD_API_DISABLED)
Dashboard:Api:AuthMode default updated from Unsecured → ApiKey
Dashboard:Api:PrimaryApiKey default updated to note auto-generation

aspire otel logs/spans/traces command reference — Added missing --dashboard-url and --api-key options, plus examples showing the new login URL feature (paste `(localhost/redacted) and the token is auto-exchanged).

aspire otel overview page — Updated description to mention standalone dashboard usage with login URLs.

⚠️ The draft PR needs human review before merging — please verify option names and behavior descriptions match the shipped CLI.

Generated by PR Documentation Check for issue #16326 · ● 5.5M · ◷

- Dashboard:Api:Enabled now defaults to true (API enabled by default) - Dashboard:Api:AuthMode now defaults to ApiKey - Add Dashboard:Api:Disabled as the new preferred config to disable the API - Mark Dashboard:Api:Enabled as deprecated in docs - Update PrimaryApiKey default to note auto-generation - Add --dashboard-url and --api-key options to aspire otel logs/spans/traces - Document login URL support: passing http://host/login?t=<token> auto-exchanges the token for an API key - Update aspire otel main page description to mention standalone dashboard usage Documents changes from microsoft/aspire#16326 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

- Dashboard:Api:Enabled now defaults to true (API enabled by default) - Dashboard:Api:AuthMode now defaults to ApiKey - Add Dashboard:Api:Disabled as the new preferred config to disable the API - Mark Dashboard:Api:Enabled as deprecated in docs - Update PrimaryApiKey default to note auto-generation - Add --dashboard-url and --api-key options to aspire otel logs/spans/traces - Document login URL support: passing http://host/login?t=<token> auto-exchanges the token for an API key - Update aspire otel main page description to mention standalone dashboard usage Documents changes from microsoft/aspire#16326 Co-authored-by: aspire-repo-bot[bot] <268009190+aspire-repo-bot[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

JamesNK changed the title ~~Fix otel standalone dashboard UX around --dashboard-url and --enable-api~~ Enable telemetry API by default and add login token exchange for standalone dashboard Apr 20, 2026

JamesNK added 6 commits April 20, 2026 15:24

Use KnownConfigNames/DashboardConfigNames, fix stale --enable-api mes…

3c1b677

…sage, update xlf files

Clean stale managed publish output in localhive scripts

5b324ad

Merge branch 'fix/localhive-stale-managed-build' into fix/otel-dashbo…

0dac957

…ard-url-ux

JamesNK changed the title ~~Enable telemetry API by default and add login token exchange for standalone dashboard~~ Enable dashboard telemetry API by default with ApiKey auth and login token exchange Apr 20, 2026

JamesNK marked this pull request as ready for review April 20, 2026 15:56

Copilot AI review requested due to automatic review settings April 20, 2026 15:56

JamesNK requested review from adamint, davidfowl and mitchdenny as code owners April 20, 2026 15:56

Copilot started reviewing on behalf of JamesNK April 20, 2026 15:56 View session

Copilot AI reviewed Apr 20, 2026

View reviewed changes

JamesNK added 3 commits April 21, 2026 00:20

Add test for unexpected status code in token exchange

f532ce2

github-actions Bot mentioned this pull request Apr 20, 2026

[pull requests] Review required #13834

Open

Fix dashboard test to send token as JSON body instead of query string

aa32b23

The /api/validatetoken endpoint was changed to accept [FromBody] ValidateTokenRequest but the test was still sending the token as a query parameter.

adamint approved these changes Apr 20, 2026

View reviewed changes

adamint reviewed Apr 20, 2026

View reviewed changes

Comment thread src/Aspire.Dashboard/Configuration/DashboardOptions.cs

JamesNK enabled auto-merge (squash) April 21, 2026 03:09

JamesNK merged commit 1cb03d8 into main Apr 21, 2026
284 checks passed

github-actions Bot added this to the 13.3 milestone Apr 21, 2026

aspire-repo-bot Bot mentioned this pull request Apr 21, 2026

[docs] Dashboard telemetry API defaults and otel command standalone usage microsoft/aspire.dev#732

Merged

	<value>Could not fetch telemetry data from the dashboard. The dashboard is not available.</value>
	<value>Could not fetch telemetry data from the dashboard: the dashboard is not available.</value>

	<value>Base URL of a standalone Aspire Dashboard (e.g. http://localhost:18888). Login URLs are also accepted and automatically normalized</value>
	<value>Base URL of a standalone Aspire Dashboard (e.g. http://localhost:18888). Login URLs are also accepted and automatically normalized.</value>

	<value>Authenticate with the dashboard using a --dashboard-url value that includes a valid login token (e.g. http://localhost:18888/login?t=TOKEN), or specify --api-key with a key matching the dashboard's configured API key.</value>
	<value>Authenticate with the dashboard either with a --dashboard-url including a valid login token (e.g. http://localhost:18888/login?t=TOKEN), or with an --api-key matching the dashboard's configured API key.</value>

Conversation

JamesNK commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Dashboard API defaults

CLI changes

Dashboard endpoint

Other

Checklist

Uh oh!

github-actions Bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

adamint Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

JamesNK Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

adamint Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

adamint Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

adamint Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

adamint Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

adamint left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 21, 2026

Uh oh!

aspire-repo-bot Bot commented Apr 21, 2026

Uh oh!

aspire-repo-bot Bot commented Apr 21, 2026

Changes included

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

JamesNK commented Apr 20, 2026 •

edited

Loading

github-actions Bot commented Apr 20, 2026 •

edited

Loading