[dashpole]

Related to #1344, #4390, open-telemetry/opentelemetry-configuration#257, open-telemetry/opentelemetry-java-contrib#2020, open-telemetry/opentelemetry-go#4536

Changes

This OTEP proposes introducing an Authenticator SDK plugin component for dynamic client authentication in exporters (with initial support on otlp/http and otlp/grpc across traces, metrics, and logs), configured programmatically or via Declarative Configuration (authenticator/development).

Specifically, this proposal draws a boundary between cross-language behavioral requirements (which are specified) and language-idiomatic transport interfaces (which are left to each SDK):

• New Common SDK Authenticator Specification (specification/auth/sdk.md): Defines Authenticator as a general HTTP/gRPC exporter authentication plugin component (supporting per-request dynamic headers/metadata or language-native HTTP transport wrappers / gRPC per-RPC credentials, request context with endpoint and timeout/cancellation, and optional Shutdown) operating strictly at the transport layer without requiring byte[] payload materialization.

• OTLP Exporter Specification (specification/protocol/exporter.md): Specifies per-attempt execution (including retries), case-insensitive header/metadata precedence over static Headers, preservation of exporter TLS/mTLS and compression settings when using transport/credential wrappers, shared export timeout budget, telemetry-induced-telemetry loop suppression, error handling, and Shutdown propagation.

• Declarative Configuration (specification/configuration/sdk.md & opentelemetry-configuration): Adds [exporter authenticator] (ExperimentalAuthenticator) to the supported SDK plugin components table and adds an optional authenticator/development property to OTLP HTTP and gRPC exporters.

• Related issues Exporter authentication #1344, Limited OTLP exporter request authentication methods #4390, Add ability to configure dynamic auth headers opentelemetry-configuration#257

• Related OTEP(s) N/A

• Links to the prototypes (when adding or changing features):

  • Draft Specification changes: main...dashpole:opentelemetry-specification:exporter-auth-spec
  • Declarative Configuration schema (opentelemetry-configuration): open-telemetry/opentelemetry-configuration@main...dashpole:opentelemetry-configuration:exporter-auth
  • Go (opentelemetry-go, http.RoundTripper + credentials.PerRPCCredentials in sdk/auth/x): open-telemetry/opentelemetry-go@main...dashpole:opentelemetry-go:exporter-auth
  • Java (opentelemetry-java, Authenticator + Declarative Config ComponentProvider): open-telemetry/opentelemetry-java@main...dashpole:opentelemetry-java:exporter-auth
  • Python (opentelemetry-python, Authenticator + entry-point plugin): open-telemetry/opentelemetry-python@main...dashpole:opentelemetry-python:exporter-auth
  • JS/TS (opentelemetry-js, Authenticator across Node HTTP, Fetch, and gRPC): open-telemetry/opentelemetry-js@main...dashpole:opentelemetry-js:exporter-auth

• CHANGELOG.md file updated for non-trivial changes

• Spec compliance matrix updated if necessary (N/A for an OTEP)

• Declarative config data model is updated if SDK config surface is changed (N/A for an OTEP)

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on reviewers · refreshed 2026-10-29 14:39 UTC

Review the latest changes.

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.