Datadog Upgrades API Authentication Detection for Security Teams
API security is getting harder to manage. Indeed, many organizations run hundreds or thousands of API endpoints, and each one handles authentication differently. Some rely on standard headers. Others use API keys or custom JSON Web Token mechanisms built by individual teams. As systems grow, therefore, security teams struggle to know which endpoints truly require authentication, and which are dangerously exposed.
Datadog is tackling this problem directly. On May 22, the company announced significant improvements to API authentication detection within Datadog App & API Protection. Specifically, the update focuses on three things: provable signals, visible evidence, and customizable rules, all aimed at reducing ambiguity and cutting false positives.
Previously, many detection tools inferred authentication status. If no authentication signal appeared, the tool assumed the endpoint was unauthenticated. That approach, however, created too much noise and left security teams unsure which findings to trust.
Datadog’s new approach changes that logic entirely. Now, the system only flags an endpoint as authenticated when it finds clear, verifiable evidence, such as trace signals, tag mappings, or integration data. Similarly, it only marks an endpoint as unauthenticated when explicit proof confirms that authentication is missing. Moreover, endpoints without enough evidence either way receive an “undetected” label, so teams can handle them separately. As a result, this three-tier classification reduces both false positives and false negatives at the same time.
The API Inventory inside App & API Protection now includes a dedicated authentication status column. Each endpoint displays one of three labels: authenticated, unauthenticated, or undetected. Furthermore, security teams can hover over any status to see exactly which detection method the system used and what signals it matched. From there, they can click “View traces” or “View schema” to validate evidence without leaving the dashboard.
Customization is also a major part of this update. Many organizations use nonstandard authentication mechanisms, custom headers, proprietary tokens, or team-specific tagging conventions. Standard detection tools often miss these entirely. To address this gap, Datadog’s new endpoint tagging rules let security teams define exactly how App & API Protection identifies authentication in their environment. For instance, a team can specify that a request is authenticated when a particular header is present or when a span tag matches a set value.
Crucially, these tagging rules are delivered through Remote Configuration. That means changes take effect immediately, without redeployments or tracer updates. Consequently, as services evolve, teams can iterate on detection logic without friction.
Beyond detection, the update also improves what happens next. The API Findings list now includes clear remediation guidance for each authentication issue. Each finding links directly to the endpoint and its detection evidence. Additionally, from the same side panel, security teams can open the tagging configuration with relevant fields pre-filled, making it straightforward to update detection logic or validate assumptions in one place.
In short, Datadog’s improved API authentication detection gives security teams what they have long needed: confidence in their findings, context behind each result, and the flexibility to adapt detection to their environment. For teams managing complex, evolving API landscapes, that combination is significant.
