Create access tokens

Prerequisites

Create purpose-specific organization access tokens for telemetry ingestion and any API operations required by the migration wave.

Confirm that:

• Network connectivity validation is complete.
• You are an organization administrator with permission to create organization access tokens.
• Token owners, naming conventions, expiration requirements, and storage requirements are defined.
• You know which applications, Collectors, and migration operations require tokens.

Determine which tokens you need

Create only the token types required by the migration wave:

For an APM migration, use the table to identify the required tokens:

For an APM migration, create an Ingest token. Create an API token for configuring a Migration Tool destination connection and migrating configuration artifacts. Do not create a RUM token unless you separately include Real User Monitoring in scope.

Decide when to use separate tokens

Decide which applications, Collectors, environments, or migration processes can safely use the same token. Create a separate token when any of the following differ:

Multiple agents or Collectors can share an Ingest token when they operate in the same environment and have the same owner, purpose, expiration, and rotation requirements. Use a separate API token for Migration Tool or other approved automation.

For example:

Follow your organization’s token-naming convention. Use names that identify the environment, purpose, and authorization scope.

For each planned token, record its:

• Name
• Authorization scope
• Environment
• Purpose and systems or processes that use the token
• Owner
• Expiration and rotation requirements

Create an organization access token

Follow Create and manage organization access tokens to create each planned token.

Use the following migration-specific guidance:

After creating a token, store its value in your organization’s approved secret manager. Record only its name, owner, expiration date, and secret-manager reference in the migration plan. Repeat the steps for each required token.

If you are configuring a Migration Tool destination connection, create an organization access token with the API authorization scope and the admin role. The admin role is mandatory for the destination connection and for migration operations that create webhook integrations and Business Transaction rules. See About roles in Splunk Observability Cloud.

After creating the token, add it to the destination connection and test the connection. See Configure Connections.

Validate token permissions

Before using a token, confirm its configuration in Settings > Access Tokens:

• The token is active and belongs to the destination organization.
• The authorization scope matches its purpose.
• An Ingest token has the Ingest scope.
• A Migration Tool API token has the admin role. Other API tokens have the role required for their operations.
• The token has not expired.
• Only approved users or teams can view it.

Then validate each token by performing its intended operation:

See Create and manage organization access tokens and Configure Connections.

Protect and manage the tokens

Access tokens provide ongoing access to Splunk Observability Cloud within their assigned scope and role. Protect token values to prevent unauthorized use, and assign ownership and lifecycle controls so that expiration or rotation does not interrupt telemetry ingestion or migration operations:

• Give each token a documented owner.
• Grant only the required authorization scope and API role.
• Limit who can view or use the token.
• Store token values in an approved secret manager.
• Do not place token values in tickets, migration plans, reports, screenshots, email, chat, or source control.
• Record the expiration date and rotation schedule.
• Update every consumer when rotating a token.
• Revoke temporary migration tokens when you no longer require them.

Confirm readiness

Confirm that:

• [ ] Each token has one documented purpose and owner.
• [ ] You created the required ingest token.
• [ ] You created an API token only if the migration wave requires API operations.
• [ ] Each token has the correct scope.
• [ ] Migration Tool API token has the admin role; other API tokens use the least-privileged role required for their operations.
• [ ] You restricted token visibility to approved users or teams.
• [ ] You configured expiration alerts and rotation ownership.
• [ ] You stored token values in an approved secret manager.
• [ ] No token value appears in the migration documentation.

After completing these checks, continue to Send and Verify a Test Metric.