[BUG] Can't query logs with OAuth

[bhrutledge]

Describe the bug

When I try any of the three methods for querying logs, I get an error that an endpoint doesn't support OAuth authentication. Other commands like go monitors list work as expected.

To Reproduce

% pup logs query --query="status:error env:prod" --from="1h"                                        
Error: endpoint POST /api/v2/logs/events does not support OAuth authentication. Please set DD_API_KEY and DD_APP_KEY environment variables

% pup logs list --query="status:error env:prod" --from="1h"
Error: endpoint POST /api/v2/logs/events does not support OAuth authentication. Please set DD_API_KEY and DD_APP_KEY environment variables

% pup logs search --query="status:error env:prod" --from="1h"
Error: endpoint POST /api/v2/logs/events/search does not support OAuth authentication. Please set DD_API_KEY and DD_APP_KEY environment variables

Expected behavior

I'd expect the query and list commands to work.

Environment

• OS: macOS
• Pup version: dev (via go install this morning)
• Go version: 1.26.0
• Authentication method: OAuth2

Command output

See above

Additional context

N/A

[platinummonkey]

hey yes, similar to #45 these APIs internally need to add oauth support. Today you'll need API/APP key pairs to use these

[danihodovic]

Hey @platinummonkey I'm running into the same problem but with API/APP authentication. Do you know what scopes are required for the keys?

$ pup logs search --query='"KO delete"' --from=4h --limit=1000
Error: failed to search logs: 401 Unauthorized
Status: 401
API Response: {"errors":["Unauthorized"]}

Request Details:
- Query: "KO delete"
- From: 2026-02-19T18:28:26Z UTC (parsed from: 4h)
- To: 2026-02-19T22:28:26Z UTC (parsed from: now)
- Limit: 1000

Troubleshooting:
- Verify your time range is valid
- Check that your query syntax is correct
- Ensure you have proper permissions

[platinummonkey]

they would need logs_read_data and logs_read_index_data, there is some nuance as logs can have additional granular access rules based on the query or index the data is in.

[danihodovic]

I've enabled both and I still get a 401

[danihodovic]

Actually never mind, I had to create both an API key and an APP key. Sorry for the confusion!

[platinummonkey]

Note: this bug reappeared in the rust conversion. Will fix this morning. For folks reading please use v0.21.1

[FelipeLahti]

Hey! Thanks for looking into this.
v0.21.1 don't exist on the releases from what I saw and v0.21.0 had the same error.

I installed v0.10.0 and it worked (I version I got when I first tested this during the release that was working).

Workaround for now:

  git clone https://github.com/datadog-labs/pup.git /tmp/pup-build
  cd /tmp/pup-build
  git checkout v0.10.0
  go build -o pup .

  # Install to a directory in your PATH
  cp pup /usr/local/bin/pup

[platinummonkey]

the underlying endpoints for those commands still don't support oauth, for now continue to use api/app keys. There are a few in this category that internally working to add proper oauth support for.

[mikolaj-matuszny-ext-sonarsource]

I have similar issue for CI visibility. I had to set API and APP key manually to work around this.