Authentication overview

STACKIT Telemetry Router separates authentication into two distinct paths: instance management (via the STACKIT Portal or CLI) and access tokens (JWT), which are required to authorize data sources (such as Telemetry Links) to interact with your router’s endpoints and send data.

Authentication Cases

The table below explains each case, its purpose, and the required authentication method.

Use Case	Purpose	Tool / Authentication Method
Service Management	Administering your Telemetry Router instance (e.g., creating destinations or managing access tokens).	STACKIT Portal or STACKIT CLI (authenticates natively via your user or service account session).
Data Ingest Access	Authorizing data sources (like Telemetry Links) to route telemetry data into your router instance’s endpoints.	Access Tokens (JWT) generated within the instance dashboard (Access tokens section) or via the API.

Prerequisites

Before you can configure technical access or manage your router, ensure the following foundational conditions are met:

• You have a STACKIT user account.
• Your organization has an active STACKIT customer account.
• You have created a project within your customer account.
• You have provisioned a Telemetry Router instance, and its status displays as Active.

---

Use Case 1: Service Management

To perform administrative tasks, such as configuring your router or adding destinations, you can use the STACKIT Portal or the STACKIT CLI. The CLI leverages your active session for seamless authentication against the STACKIT API.

We officially support and recommend using the STACKIT CLI for automated Telemetry Router API operations. It replaces legacy methods that rely on manual service account token generation and raw HTTP client requests, significantly streamlining your authentication lifecycle.

For complete installation guidelines, configuration steps, and a comprehensive command reference, review the official STACKIT-CLI GitHub Repository.

If you are using the CLI and need help finding your required instance identifiers, refer to our guide on Interacting with the Telemetry Router API.

Use Case 2: Data Ingest Access

For data to flow successfully into your Telemetry Router, the sender must be authorized. This is done using specific JSON Web Tokens (JWT) generated exclusively for the Telemetry Router.

Whether you are configuring a native STACKIT Telemetry Link or interacting directly with the router’s ingest endpoint, these tokens act as your data plane credentials.

Obtaining Access Tokens

You can retrieve or generate the required JWT access tokens using either the STACKIT Portal or the Telemetry Router API.

Because these tokens grant direct access to push data to your router, you have the option to assign them a limited time-to-live (TTL) in days, or set them to have an unlimited lifetime.

For security reasons, access tokens are only displayed once immediately after creation. Ensure you copy the token to a secure location. If you lose an access token, you cannot retrieve it and must generate a new one.

Next Steps

To see the exact steps and API payloads for creating, viewing, editing, and deleting these JWTs, proceed to our dedicated how-to guide:

• How to create and manage access tokens