Amazon CloudWatch now supports X-Ray bearer token authentication for OpenTelemetry trace ingestion. The November 3, 2026 update is aimed at exporters that can send OTLP/HTTP spans but cannot sign requests with AWS Signature Version 4 (SigV4). It changes how those clients authenticate—not the trace destination or the tracing product itself.
What the diagram shows — and what it does not
OpenTelemetry traces reach the same AWS X-Ray OTLP/HTTP endpoint whether the sender authenticates with SigV4 or an eligible bearer token. The diagram compares credential paths; it does not imply lower cost, higher performance or broader region support.
What Happened
The November 3 AWS announcement describes an authentication change rather than a new ingestion endpoint: a client can attach an X-Ray service-specific bearer token to its HTTP Authorization header instead of signing each request with SigV4. For a third-party OpenTelemetry exporter, that may remove the need for a request-signing proxy.
AWS Distro for OpenTelemetry (ADOT) still uses SigV4 by default. The bearer-token option targets integrations that cannot readily use an AWS SDK, IAM role or temporary credentials.
Who Is Affected & When
The announcement is dated November 3, 2026, and describes the capability as available rather than as a future beta. AWS lists support in commercial Regions where the X-Ray OTLP traces endpoint exists. Check the supported Region list for your intended deployment before updating the exporter; Transaction Search remains a separate prerequisite.
Consider an OTLP/HTTP collector running on a local server or in another cloud: passing a bearer token to its exporter may be easier than adding AWS request signing. The same constraint can affect CI pipelines and third-party monitoring tools. If traces already reach CloudWatch through SigV4, there is no need to migrate. AWS announced no separate pricing or performance tier for this authentication option.
What Changes in Practice
The X-Ray OTLP traces endpoint configuration is unchanged: https://xray.REGION.amazonaws.com/v1/traces. Only the sender’s authentication configuration changes. For the OpenTelemetry Collector, AWS documents the bearertokenauth extension, which reads a token from a file or an injected environment variable. Keep that secret out of source control.
| Decision point | SigV4 with short-term credentials | X-Ray bearer token |
|---|---|---|
| Recommended default | Yes, according to AWS | Fallback when temporary credentials are impractical |
| Client requirement | Can sign AWS requests | Can set an HTTP Authorization header |
| Credential handling | Temporary AWS credentials and IAM policies | X-Ray-specific service credential associated with an IAM user; rotate regularly |
| Trace destination | X-Ray OTLP traces endpoint | Same X-Ray OTLP traces endpoint |
| Observability features | CloudWatch trace features | Transaction Search (required for OTLP traces); Application Signals and Omni have separate setup requirements |
Editorial comparison based on AWS documentation, checked November 5, 2026; not a hands-on benchmark.
For CloudWatch trace ingestion IAM permissions, the documented policy grants xray:CallWithBearerToken and xray:PutTraceSegments. A bearer token cannot be used to read X-Ray trace data or to administer other X-Ray APIs. AWS also states that the CloudWatch Transaction Search prerequisite must be met before the OTLP traces endpoint can accept spans. Enabling an API key does not automatically configure Transaction Search.
X-Ray API key rotation and expiration need a plan before the first token is deployed. IAM permits two X-Ray API keys per IAM user, so a team can issue the replacement, update exporters, confirm trace delivery and then disable the old credential. AWS also allows a key with no expiry date; a deliberate lifetime is the safer choice. Enable CloudTrail data events if an audit trail of token-based trace submissions is required.
A practical rollout checklist for external workloads
For teams sending OpenTelemetry traces from on-premises applications to CloudWatch, first check whether the OTLP/HTTP exporter supports temporary AWS credentials. If SigV4 is already practical, a second credential lifecycle needs a good reason. When a vendor accepts only a static Authorization header, an X-Ray API key may eliminate the signing bridge.
For OpenTelemetry Collector bearer token setup, first confirm that the installed collector version supports the bearertokenauth extension. Inject the token from a mounted secret or a secrets manager, not source control. Confirm the target Region and Transaction Search configuration before your first test span, so an unavailable endpoint is not mistaken for a credential problem.
CloudWatch trace ingestion error handling matters once the pipeline runs. AWS’s X-Ray troubleshooting guidance says an invalid, inactive or expired token—or insufficient IAM permissions—returns HTTP 403. A temporary service authentication issue returns HTTP 503 and should be retried with backoff. If spans target custom CloudWatch log groups, check any additional Logs permissions separately from the trace policy.
Why It Matters
An exporter that understands OTLP/HTTP but cannot sign AWS requests may otherwise need an intermediary before CloudWatch accepts its spans. An X-Ray bearer token can remove that component for eligible integrations. The compromise is operational rather than technical: someone must own token expiry, rotation, revocation and secure storage.
When comparing SigV4 vs bearer token authentication, focus on what your team can operate safely. IAM roles and temporary credentials avoid persistent secrets when applications can use them. A third-party integration limited to a static bearer token may justify an X-Ray API key after a security review. Trace-specific credentials are not interchangeable with CloudWatch metrics and logs API keys.
Our Take
Before changing an established OpenTelemetry Collector pipeline, identify which exporter actually cannot use SigV4. Try that exporter with a low-risk workload in the intended Region; confirm that its spans reach CloudWatch Transaction Search, and record who will rotate the token. A quicker initial setup is less valuable if maintaining long-lived credentials adds more work later.
DigiOffly has not performed a hands-on test of X-Ray API keys, sent sample spans, verified account-specific billing, or benchmarked latency. The feature description above is based on AWS’s announcement and technical documentation; deployment advice is editorial analysis.
CloudWatch OpenTelemetry Traces FAQ
Can I use an API key instead of SigV4 to send OpenTelemetry traces?
Yes, for supported X-Ray OTLP/HTTP trace ingestion. The client must send a valid X-Ray service-specific bearer token in its Authorization header. SigV4 remains AWS's recommended method.
Does the new CloudWatch authentication method cover metrics and logs?
This November announcement specifically concerns traces. CloudWatch documents metrics and logs as separate OTLP endpoints with their own bearer-token configuration and credential requirements.
Can an X-Ray API key read trace data?
No. AWS documents these keys as scoped to sending spans through the OTLP traces endpoint, not reading traces or calling general X-Ray APIs.
What should teams verify before switching authentication?
Check regional availability, Transaction Search, least-privilege IAM permissions, TLS, secret storage, key expiry, rotation and the client's OTLP/HTTP exporter configuration. Test in a nonproduction account before relying on the pipeline.
Official Sources & Dates
- AWS What’s New — API keys for OpenTelemetry traces, announced November 3, 2026.
- AWS X-Ray — bearer-token authentication for traces, technical guidance checked November 5, 2026.
- Amazon CloudWatch — OTLP endpoints, endpoint and protocol reference checked November 5, 2026.