Send Feature Flagging API key fingerprint

[leoromanovsky]

Motivation

The Feature Flags CDN needs a stable API-key identifier without writing the raw API key to CDN backend API logs. SDKs must send the Clifford v1 fingerprint so ffe-service can verify and log the fingerprint instead of the credential.

Changes and Decisions

• Generate the Clifford v1 fingerprint with SHA-256 and the Datadog base62 format.
• Send DD-API-KEY-FINGERPRINT with DD-API-KEY for Datadog-managed HTTPS endpoints.
• Keep custom endpoint and insecure HTTP credential behavior unchanged.

[datadog-official]

🎯 Code Coverage (details)
• Patch Coverage: 85.00%
• Overall Coverage: 75.77% (+17.99%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: fe91ced | Docs | Datadog PR Page | Give us feedback!}

[dd-octo-sts]

🟡 Java Benchmark SLOs — Performance SLO warning (near threshold)

Suite	Status
Startup	🟡 warning

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.00 s	13.96 s	[-0.5%; +1.0%] (no difference)
startup:insecure-bank:tracing:Agent	12.97 s	12.93 s	[-0.5%; +1.0%] (no difference)
startup:petclinic:appsec:Agent	16.84 s	16.67 s	[+0.3%; +1.7%] (maybe worse)
startup:petclinic:iast:Agent	16.82 s	16.92 s	[-1.4%; +0.3%] (no difference)
startup:petclinic:profiling:Agent	16.61 s	16.77 s	[-2.0%; +0.0%] (no difference)
startup:petclinic:sca:Agent	16.08 s	15.93 s	[-6.2%; +8.2%] (unstable)
startup:petclinic:tracing:Agent	16.11 s	15.99 s	[-0.3%; +1.8%] (no difference)

Commit: fe91ced2 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[datadog-official]

More details

The independently executed SHA-256/base62 conversion produced the specified Clifford fingerprints for empty, ordinary, Unicode, leading-zero, and configured API-key inputs. The request path gates the new header behind the same managed-HTTPS condition as the API-key credential, so custom and HTTP endpoints remain excluded. No additional tests recommended: the existing test suite already covers the endpoint-routing and authoritative fingerprint vectors.

Was this helpful? React 👍 or 👎

_{📊 Validated against 5 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit fe91ced · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[sameerank]

I haven't been following the solution-ing around this. We'll be maintaining an internal map to decode the fingerprints?