open-telemetry / open-telemetry/opentelemetry-cpp
[FEAT] Implement plugable authentication for OTLP HTTP
@marcalff is already working on this.
Since Nov 21, 2025.
- Dominant language
- C++
- Stars
- 1.4k
- Forks
- 632
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 75
Description
Many systems expose an OTLP HTTP endpoint.
Currently, the only auth supported by opentelemetry-cpp in the OTLP HTTP exporter, is to provide an http header in plain text, with magic key/value pairs, used to represent a long lived auth token (immutable for the life cycle of the exporter).
opentelemetry-cpp needs to be expanded to:
- Define an OTLP HTTP authentication interface
- Allow the OTLP HTTP exporter to use an arbitrary authentication
- Sign HTTP requests using the authentication implementation provided
- Notify the authentication implementation of failures, to support rotation of credentials
When an application wants to talk to an endpoint using the XYZ authentication method, the application is then responsible to provide an authentication plugin that implements the XYZ method.
Authentication plugins are a natural extension point for file configuration, see related:
Sub tasks:
- Move all the compression code from the HTTP layer to the OTLP layer
- Isolate a compression interface
- Implement compression in a separate code base for gzip
- Isolate an authentication interface
- Implement authentication in a separate code base for basic auth
- Change OTLP HTTP exporters to accept a custom compression
- Change OTLP HTTP exporters to accept a custom authentication
- Support rotation of SSL certificates
- Support rotation of credentials
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.