Skip to content
telemioDeveloper Docs
Open console
DOCUMENTATIONSecurity · Least privilegeBrowse integrations ↗
Docs/Developer Connect/Credentials and security
Security · Least privilege

Security

A predictable access model for automation without sharing ingest credentials.

AI-READY REFERENCE

Pass this guide to your agent

Short, page-specific instructions for an AI coding assistant.

Markdown ↗
Preview agent instructions 
# Telemio agent instructions — Security and credentials

Review a Telemio integration for least-privilege access. Separate OAuth/MCP user authorization, workspace read credentials, server ingest secrets, and browser-safe ingestion keys. Keep tokens in a trusted secret manager, never source code, chat, logs, or Zap step output. Verify workspace isolation, revocation, error handling, and minimal data export before using a third-party system.

Reference: https://telemio.sh/docs/integrations/security.html

Read credentials are not ingest credentials

Use read-scoped workspace MCP credentials for the initial server-to-server Developer Connect API. Workload ingest credentials are used to submit telemetry, not to retrieve it. Store both in the connector’s secure credential manager and never paste them into AI chats, published workflows, or source control.

Choose one workspace

Create the connection in the intended workspace. The API must not return data for other workspaces.

Use only read scope

Use a read-only key and an optional service allowlist. Do not grant write access to automation that only needs summaries or runtime data.

Store and rotate securely

Use supported MCP connections or the read-only Developer Connect API for custom applications. Keep ingest credentials separate from read credentials.

Limit downstream exposure

Be careful about forwarding raw telemetry, trace attributes, or runtime metadata into third-party applications. Follow your organization’s data handling policy.

What is not enabled

Developer Connect v1 does not provide generic third-party OAuth app registration, webhook subscriptions, delivery retries, or automatic permission grants for connected applications. The Telemio MCP OAuth client used by approved AI connectors is not a public third-party application registration service.

Security checklist

  • Use HTTPS and a trusted, server-side credential store.
  • Do not grant repository permissions to a Telemio API credential.
  • Limit polling frequency and respect authentication or rate-limit responses.
  • Revoke a compromised or unused key in Telemio.
  • Check workspace authorization before you share query results downstream.