User configuration¶
DDQA will always ensure valid config by loading the configuration screen if there are errors or missing required fields.
Tip
To locate your personal config file you may run: ddqa config find
GitHub auth¶
You'll need to create a fine-grain access token using DataDog resource owner.
Restrict its access to the list of repositories you are creating cards for (e.g. DataDog/datadog-agent).
Set the required permissions: - Content: read-only and Pull requests: read-only repository permissions. - Members: read-only organization permission.
The following APIs are used:
/search/issues(GET)/repos/{owner}/{repo}/pulls/{pull_number}/reviews(GET)-
/orgs/{org}/teams/{team_slug}/members(GET)Note
This endpoint is not yet supported when using fine-grained personal access tokens.
Tip
You can configure your GitHub credentials using the DDQA_GITHUB_USER and DDQA_GITHUB_TOKEN environment variables.
Jira auth¶
You'll need to create an API token with the appropriate scopes.
The following APIs are used:
/rest/api/2/issue(POST)/rest/api/2/myself(GET)/rest/api/2/search(POST)/rest/api/2/issue/{issueIdOrKey}/transitions(GET, POST)/rest/api/2/user/bulk(GET)
Example: JIRA API token Scopes (14 Nov 2025)¶
Write
write:issue:jira
write:issue.property:jira
write:comment:jira
write:comment.property:jira
write:attachment:jira
Read
read:issue.transition:jira
read:status:jira
read:field-configuration:jira
read:issue-details:jira
read:field.default-value:jira
read:field.option:jira
read:field:jira
read:group:jira
read:application-role:jira
read:user:jira
read:avatar:jira
read:issue:jira
read:issue:jira-software
Tip
You can configure your Jira credentials using the DDQA_JIRA_EMAIL and DDQA_JIRA_TOKEN environment variables.
Datadog auth¶
Only needed when your repository is configured with datastore_id. If it instead uses global_config_source, the GitHub-username-to-Jira-account-ID mapping is read from a GitHub-hosted TOML file and no Datadog credentials are required.
When datastore_id is used, the mapping is stored in a Datadog Actions Datastore rather than in a GitHub repository, so ddqa needs a Datadog API key and application key with access to it.
The following API is used:
/api/v2/actions-datastores/{datastore_id}(GET)/api/v2/actions-datastores/{datastore_id}/items(GET)
Recommended: ephemeral credentials via dd-auth¶
The [datadog] config table is not required. The recommended way to authenticate is to mint short-lived credentials with dd-auth and run ddqa as its subcommand, so no Datadog secret is ever written to disk. Since dd-auth exports DD_API_KEY/DD_APP_KEY by default, rename them to the variables ddqa reads:
dd-auth --actions-api --api-key-env DDQA_DATADOG_API_KEY --app-key-env DDQA_DATADOG_APP_KEY -- ddqa sync
Alternative: persistent credentials¶
If you'd rather not run dd-auth every time, you can create a long-lived API key and application key under Organization Settings and store them either as environment variables:
export DDQA_DATADOG_API_KEY="..."
export DDQA_DATADOG_APP_KEY="..."
or persistently in your personal config file's [datadog] table (via the configuration screen, or ddqa config set datadog.api_key ...).