Dynatrace SaaS Token Service issues, validates, and manages the token lifecycle. This includes
The following token types are issued by the token service relevant to IAM.
| Token type | Description | Who can generate | Expiry configurable? | Scope | Usage | Example use cases |
|---|---|---|---|---|---|---|
ID | User identity information | Users, applications | No | User identity attributes | Authentication | Verifying user identity, SSO, introspection API endpoints |
OAuth | OAuth 2.0 authentication, granting access to resources | Administrators | No | Defined by administrator at token creation | API access, third-party integrations | Grant external tools or scripts access to Dynatrace APIs with scoped user permissions. |
Platform | Regular user’s platform access automations | Users | Yes | User-specific permissions | API access | Schedule Grail query for data export, ingest events via the API |
Service | Machine-to-machine authentication and authorization | Administrators | No | Defined by administrator at token creation | Workflow automations | Workflow automation |
Workload identity federation lets an external workload call the Dynatrace API with a token issued by its own identity provider, such as Microsoft Entra ID, GitHub Actions, or Google Cloud. The workload passes that token as a bearer token, and Dynatrace resolves it to a service user, so you don't need to store a Dynatrace client secret or platform token alongside the workload.
Two objects make this work.
For configuration steps and examples, see Workload identity federation.