> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Create an Observe datastream and token

> Steps to create an Observe datastream, issue an ingest token, and confirm the OTLP endpoint before deploying a collector.

Observe receives data on a per-account endpoint and authenticates with a datastream token. Collect both values before you configure the collector.

## Find your customer ID

Your customer ID is the 12-digit number in the portal URL:

```text theme={null}
https://123456789012.observeinc.com
```

The ingest hostname adds `collect.` to that same number:

```text theme={null}
https://123456789012.collect.observeinc.com
```

<Note>
  The `collect.` hostname is required. Observe uses it to route and load balance ingest traffic.
</Note>

## Create a datastream and token

Perform the following steps:

<Steps>
  <Step>
    Log in to your Observe account.
  </Step>

  <Step>
    In the left navigation rail, select **Data & integrations** > **Datastreams**.

    <Check>
      This opens the Datastreams page, which lists existing datastreams with their status, health, and ingest volume.
    </Check>
  </Step>

  <Step>
    Select **\[ Create Datastream ]**.
  </Step>

  <Step>
    Enter a **Name** that identifies the data, for example `futurex-hsm-syslog`. A **Description** is optional.
  </Step>

  <Step>
    Set the retention period, then select **\[ Create ]**. The default retention is thirteen months, and you can change it later.
  </Step>

  <Step>
    Select the new datastream's name to open it.
  </Step>

  <Step>
    Select **Create** > **Token**, enter a **Name** such as `otel-collector`, then select **\[ Continue ]**.
  </Step>

  <Step>
    Copy the token and store it securely, tick the confirmation checkbox, then select **\[ Continue ]**.

    <Warning>
      Observe displays the token value only once. You cannot retrieve it after you close the confirmation dialog. Existing tokens remain listed under the datastream, but only their metadata is visible, never the secret.
    </Warning>
  </Step>

  <Step>
    Select **\[ Close ]**.
  </Step>
</Steps>

The token contains a colon that separates the token identifier from the token secret:

```text theme={null}
ds1EXAMPLEidentifier:EXAMPLEsecretvalue
```

<Note>
  Datastream tokens are for ingest only. They cannot read data or call the Observe REST API, which requires a separate API token. That limited scope makes a datastream token the correct credential for a collector.
</Note>

## Confirm the endpoint

The OTLP endpoint path is `/v2/otel`. Signal-specific suffixes are appended by the exporter, so logs arrive at `/v2/otel/v1/logs`.

<Note>
  Observe's documentation shows both `/v1/otel` and `/v2/otel` for this endpoint. Both paths accept OTLP log payloads and return `HTTP 200`. Use `/v2/otel`, which matches the current examples. Omitting the signal suffix returns `HTTP 404`.
</Note>

Verify credentials and the path before installing anything. Substitute your own values:

```bash wrap theme={null}
export OBSERVE_CUSTOMER=123456789012
export OBSERVE_TOKEN='ds1EXAMPLEidentifier:EXAMPLEsecretvalue'

curl -sS -X POST \
  "https://${OBSERVE_CUSTOMER}.collect.observeinc.com/v2/otel/v1/logs" \
  -H "Authorization: Bearer ${OBSERVE_TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"resourceLogs":[{"resource":{"attributes":[{"key":"service.name","value":{"stringValue":"futurex-hsm-test"}}]},"scopeLogs":[{"logRecords":[{"body":{"stringValue":"endpoint check"},"severityText":"INFO"}]}]}]}'
```

A successful call returns `HTTP 200`. Then search the datastream for `endpoint check` to confirm the record landed.

Interpret failures as follows:

| Response   | Cause                                                                                 |
| ---------- | ------------------------------------------------------------------------------------- |
| `HTTP 200` | Endpoint and token are correct.                                                       |
| `HTTP 404` | Wrong path. Confirm the `/v1/logs` suffix is present.                                 |
| `HTTP 401` | Token is missing, malformed, or disabled. Confirm the `Authorization: Bearer` header. |

## Store the token safely

Do not place the token in the collector configuration file. Keep it in a file that only the collector's service account can read, and pass it as an environment variable:

```bash theme={null}
install -m 600 /dev/null /etc/observe/token.env
printf 'OBSERVE_TOKEN=%s\n' "$OBSERVE_TOKEN" > /etc/observe/token.env
```

To rotate a token later, create the replacement first, switch the collector to it, confirm data still flows, then disable and delete the old token.


## Related topics

- [Log ingestion with Observe](/Integrations/VirtuCrypt/Log_ingestion_with_Observe/Log_ingestion_with_Observe.md)
- [Before you start](/Integrations/VirtuCrypt/Log_ingestion_with_Observe/Before_you_start.md)
- [Validate the integration](/Integrations/VirtuCrypt/Log_ingestion_with_Observe/Validate_the_integration.md)
- [Build datasets, dashboards, and alerts](/Integrations/VirtuCrypt/Log_ingestion_with_Observe/Build_datasets_dashboards_and_alerts.md)
- [Appendix B: Troubleshooting](/Integrations/VirtuCrypt/Log_ingestion_with_Observe/Appendix_B_Troubleshooting.md)