KeyKeeperSentry Cloud · Organization Auth Token
How an agent gets a Sentry Cloud · Organization Auth Token key through KeyKeeper, what to choose on sentry.io, and how KeyKeeper verifies it.
| Template id | sentry |
|---|---|
| Field | sentry-auth-token → SENTRY_AUTH_TOKEN · secret |
| Also | sentry-org → SENTRY_ORG · plain, confirmed by you, optional |
| Also | sentry-project → SENTRY_PROJECT · plain, confirmed by you, optional |
| Key looks like | whether it can be viewed again is unconfirmed |
| Created at | sentry.io |
| Verified by KeyKeeper | GET https://sentry.io/api/0/organizations/ — lists organizations visible to the token |
| Template checked | 2026-09-15 |
What the agent does
keykeeper providers show sentry
keykeeper save --provider sentry --from-clipboard --create --purpose "what this task does"
keykeeper run -c sentry -- <your command>--provider sentry fills in the credential id and the fields. The environment
variables are the ones Sentry Cloud · Organization Auth Token's own tools read, so nothing has to be mapped.
What only you can do
What to choose
Prefer an organization token. Reporting needs org:read/project:read; release automation should use org:ci. Do not grant write/admin scopes unless the exact task requires them.
The agent is told the same thing. It opens the page for you and says what to pick; it never logs in, passes 2FA or pays on your behalf.
What KeyKeeper checks
- Before writing: the value must look like a Sentry Cloud · Organization Auth Token key (whether it can be viewed again is unconfirmed). A wrong paste is refused before anything is stored, and the agent is told why — without the value.
- After saving: KeyKeeper itself sends
GET https://sentry.io/api/0/organizations/with the key in theAuthorizationheader (lists organizations visible to the token). The agent receives accepted, rejected or could not reach — never the value.
Rotation and expiry
No universal expiry policy was confirmed for this credential type. Record the date shown by the provider, or leave it unknown. Rotate or revoke at sentry.io.