datadog-ci "403 Forbidden" invalid API key in CI

By Daniel Zoghalchali·Latchkey

datadog-ci sent a key, but Datadog returned 403: the key is invalid, revoked, or belongs to a different Datadog site than the one the request hit. Unlike a missing key, the request was made and refused.

What this error means

datadog-ci fails with "403 Forbidden" or "Your API key is not valid", often when DD_SITE points at a region the key does not belong to.

[ERROR] Failed to upload: Forbidden (403)
  Your API key is not valid. Check DATADOG_API_KEY and DD_SITE.

Common causes

The key is wrong, revoked, or truncated

A copy-paste error, a rotated key, or a trailing newline in the secret makes Datadog treat the key as invalid.

DD_SITE does not match the key region

A key created on datadoghq.eu sent to datadoghq.com (the default) is rejected, because keys are site-specific.

How to fix it

Set the correct site for the key

1. Identify which Datadog site your org uses (com, eu, us3, us5, ap1).
2. Set DD_SITE to match the key region.
3. Re-run the upload.

env:
  DATADOG_API_KEY: ${{ secrets.DATADOG_API_KEY }}
  DD_SITE: datadoghq.eu

Rotate the key and re-store it

Create a fresh API key in Datadog, paste it into the secret without trailing whitespace, and re-run.

How to prevent it

• Match DD_SITE to the region the API key was created in.
• Store keys without trailing newlines or spaces.
• Rotate revoked keys promptly and update the secret in one place.

Frequently asked questions

Related guides

References

• GitHub Actions documentation