Skip to main content
Datadog’s MCP server supports two ways to connect, and its URL is specific to your Datadog site (region):
  • OAuth (recommended). Each person signs in with their own Datadog account. MCP Manager registers itself with Datadog automatically, and you approve a consent screen. Before the first connection, a Datadog admin must add MCP Manager’s callback URL to the organization’s allowlist.
  • Token headers. A shared service account connects with a Datadog API key plus an application key. Use this when you want one non-human identity that everyone on the gateway acts as.
This guide is a convenience based on Datadog’s setup at the time of writing. Datadog’s own MCP Server documentation is authoritative and may be more current. The requirements below — enabling MCP, allowlisting redirect URLs, the region-specific URL, scoping keys — come from Datadog, not from MCP Manager. If a step here has drifted or a connection problem is specific to how Datadog works, Datadog support is the fastest path to an answer.

​
Before you start

Bring the following before you open MCP Manager:
  • A Datadog account on a commercial site. Datadog government sites are not supported.
  • Admin access in Datadog, or an administrator who can help. Two organization settings need an admin: turning on MCP, and (for OAuth) allowlisting MCP Manager’s callback URL.
  • Your Datadog site (region). The MCP URL differs per site — datadoghq.com (US1), us5.datadoghq.com, datadoghq.eu, and so on. You can see your site in the URL bar when you’re logged into Datadog. This is the detail people most often get wrong.
  • For token headers only: the ability to create a service account and an application key, with the mcp_read permission (and mcp_write only if you need write access).

​
Prepare your Datadog organization

1

Enable MCP at the organization level

A Datadog administrator turns MCP on org-wide: Organization Settings → Preferences, then toggle on MCP Access. Enable MCP Write Access only if your users need to create or modify resources — leave it off for read-only access.
2

Resolve the MCP URL for your site

The MCP endpoint is your Datadog site with an mcp. prefix and the path /api/unstable/mcp-server/mcp:These are the six commercial sites Datadog supports. The rule is the same for each: prepend mcp. to your site domain. If you want to restrict which tools are exposed, you can append ?toolsets=all (or a narrower set) to the URL.

​
Connect with OAuth

1

Allowlist MCP Manager's callback URL in Datadog

Datadog only sends a sign-in back to redirect URLs the organization trusts. A Datadog administrator opens Organization Settings → Preferences, scrolls to MCP OAuth Redirect URLs, and adds:
Callback URL
Click Add URL, then save the entry inline — the new row has its own save control. An entry that is added but not saved looks listed but is not applied, and sign-in keeps failing.This is a one-time step per Datadog organization. Entries are matched as prefixes, so the full callback URL above is the narrowest entry that works.
2

Add the server in MCP Manager

On the Servers page, add a Remote server, paste your region-specific URL, and click Continue. Give the server a name.MCP Manager detects that Datadog supports OAuth and registers itself as a client automatically, so there is no client ID or secret to enter. See standard OAuth with dynamic client registration.
3

Approve the consent screen

Click Authenticate now. Datadog shows a consent screen for your organization with two access profiles:
  • Limited access — read-only, excluding sensitive permissions.
  • Full access — read and write, including sensitive permissions.
Choose the narrowest profile your use case needs, then click Authorize. Datadog returns you to MCP Manager, the server shows Credentials valid, and its tools are listed on the server’s Features tab, ready to add to a gateway.
If your organization manages its own OAuth client for Datadog, choose Use your own OAuth application when adding the server and enter its Client ID. The callback URL MCP Manager shows must be a registered redirect URI on that client, and it must also be allowlisted in step 1. You can leave every discovered scope unticked: MCP Manager then sends no scope, and Datadog applies its default grant.

​
Connect with token headers

Use this path for a shared service-account identity instead of per-person OAuth.
1

Create a dedicated service account

In Organization Settings → Service Accounts, create an account for the connection — for example, name it MCP Manager with the email mcp-manager-service-account@yourdomain.com. Assign whatever role makes sense for your use case, but we recommend selecting the least amount of privilege required for your use case. Make note of the role you selected, as you’ll need it in the next step.
A dedicated service account rather than a personal Datadog login means the connection survives someone leaving the team, and every Datadog action through MCP Manager is attributable to a clearly named non-human identity.
2

Grant the service account MCP permissions

Make sure the service account’s role has the mcp_read permission (Organization Settings → Roles → edit the role → Permissions → search mcp). Add mcp_write only if you enabled write access and your users need it.
3

Create an API key and an application key

Datadog’s MCP server needs two keys:
  • An API Key — created at Organization Settings → API Keys. This identifies your organization.
  • An Application Key — created on the service account at Organization Settings → Service Accounts → (your account). Scope it to mcp_read (and mcp_write if needed).
Do not be misled by the root level Application Keys navigation item, for maximum security and control create your Application Keys through a Service Account.
Copy both values now; the application key is shown only once.
4

Add the server with the two headers

On the Servers page, add a Remote server, paste your region-specific URL, and open Add connection headers (optional). MCP Manager recognizes the Datadog URL and pre-fills both header names, so you only paste the two values:
Headers
Save, and MCP Manager will store both values encrypted and attach them to every request it makes to Datadog. The server’s tools are now available to add to a gateway.

​
Gotchas & things to keep in mind

  • Region mismatch is the #1 failure. The MCP host is tied to your Datadog site — mcp.datadoghq.com, mcp.us5.datadoghq.com, and mcp.datadoghq.eu are different servers. Using the wrong one fails to connect even with valid credentials. Confirm your site before pasting.
  • “Mismatching redirect URI” means the callback isn’t allowlisted. Datadog rejects the sign-in before showing a consent screen. Check that MCP Manager’s callback URL is listed under MCP OAuth Redirect URLs and that the entry was saved.
  • invalid_scope with an empty scope list (“The following scopes are not recognized:”) came from an MCP Manager bug when connecting with Use your own OAuth application and no scope selected. It is fixed; reconnect the server if you still see it.
  • OAuth identities are per person. Each person who authorizes gets their own identity, acting with their own Datadog permissions. See per-user versus shared identity.
  • Token headers are a shared credential. Everyone on the gateway acts as the service account. Make the identity Global if the team is meant to share it, and rely on MCP Manager’s logs (not Datadog’s) for per-person attribution.
  • You need both keys, with the exact header names. For token headers, the API key and application key are different things, and Datadog’s header names use underscores — DD_API_KEY and DD_APPLICATION_KEY — not the hyphenated form (DD-API-KEY) you might expect from typical HTTP headers.
  • unstable in the path is expected. Datadog’s MCP server is a preview API (note /api/unstable/ in the URL). The endpoint and its tools may change as Datadog evolves it.
  • Read vs. write is governed in more than one place. Write access needs the org-level MCP Write Access toggle, plus either Full access on the OAuth consent screen or the mcp_write permission on the service account’s role. Leave write off unless you specifically need it — it’s the safer default and easy to grant later.
  • Government sites aren’t supported. Datadog doesn’t offer the MCP Server on its FedRAMP/GovCloud sites (ddog-gov.com, us2.ddog-gov.com) — it’s a preview feature not yet available in that environment. This is a Datadog-side limitation, not an MCP Manager one.
  • Rate limits apply per user: roughly 50 requests / 10 seconds, 5,000 calls per day, and 50,000 per month. High-volume agents should expect throttling.

​
Further reading

Find & Connect MCP Servers

How MCP Manager detects authentication type, and how to find other servers’ URLs.

How MCP Manager authenticates to a server

OAuth with dynamic registration, pre-registration, and token headers, in depth.

Export logs to Datadog

The other direction — stream MCP Manager’s audit logs into Datadog.

Identities for remote servers

Private versus Global availability for the credential you just created.

​
External sources

Datadog MCP Server documentation

Datadog’s authoritative reference for the MCP Server — availability, capabilities, and the supported sites.

Set Up the Datadog MCP Server

Datadog’s own setup steps, including the per-site MCP URL selector.