---
title: "Secure the collector connection"
description: "Send metrics over TLS or mutual TLS, trust a private CA, and authenticate to the collector with static OTLP headers."
url: https://monedula.dev/flock/docs/metrics-reporter/how-to/secure-the-collector-connection/
---
The reporter opens the connection to the collector itself, so it handles TLS and authentication for that one connection. Everything beyond it, such as credential rotation, proxies, retries and fan-out to other backends, belongs in the [OpenTelemetry Collector](https://opentelemetry.io/docs/collector/configuration/).

## Before you start

- A collector whose OTLP receiver serves TLS.
- For a private certificate authority: its CA bundle as a PEM file.
- For mutual TLS: a client certificate and its private key as PEM files.
- For header authentication: the header name and value the collector expects, such as a bearer token.
- The files must be readable by the user that runs Kafka on every broker.

## Use an https endpoint

Point the endpoint at the collector with the `https://` scheme. If the collector's certificate is signed by a CA in the JVM's default trust store, nothing else is needed for TLS:

```properties
otlp.metric.reporter.endpoint=https://otel-collector:4317
```

## Trust a private CA

When the collector's certificate comes from your own CA, give the reporter that CA's bundle:

```properties
otlp.metric.reporter.trusted.certificates.path=/etc/kafka/otlp/ca.pem
```

## Add a client certificate for mutual TLS

When the collector requires mutual TLS, set both the client certificate and its private key. One without the other is a configuration error:

```properties
otlp.metric.reporter.client.certificate.path=/etc/kafka/otlp/client.pem
otlp.metric.reporter.client.key.path=/etc/kafka/otlp/client-key.pem
```

## Send an authentication header

`otlp.metric.reporter.headers` adds static headers to every export request, as `Header-Name=value,Other=value`:

```properties
otlp.metric.reporter.headers=Authorization=Bearer <token>
```

A header value may contain `=`, but a comma always separates two headers, so a value cannot contain one. An entry with an empty name or value is a configuration error.

<Callout type="note" title="Tokens in plain text">
Header values such as bearer tokens sit in `server.properties` in plain text, readable by anyone with access to that file. To keep the token out of files on disk, use Kafka's environment-variable form, `KAFKA_OTLP_METRIC_REPORTER_HEADERS=...`, or a secrets-aware deployment system.
</Callout>

## Restart the brokers

The endpoint, headers and TLS paths are read once, when the reporter starts, and never change at runtime. Restart each broker to apply them, and again whenever you rotate a certificate or a token.

## Check it worked

- The broker log has a line that starts with `OtlpMetricReporter started` and shows the `https://` endpoint.
- In Prometheus, `monedula_reporter_export_success_total` grows and `monedula_reporter_export_failure_total` stays flat.

If a certificate or key file is missing or unreadable, a header entry is malformed, or only one of the two client TLS paths is set, the log shows `OtlpMetricReporter failed to initialize, running as no-op` with the reason; fix the setting and restart.

If the reporter starts but the collector rejects the handshake or the credentials, each failed export logs `OTLP metric export failed or timed out` and increments `monedula_reporter_export_failure_total`.

## Related

- [Configuration keys](/flock/docs/metrics-reporter/reference/configuration/) lists the TLS and header keys with their defaults.
- [Alert on broker health](/flock/docs/metrics-reporter/how-to/alert-on-broker-health/) includes alerts that fire when exports keep failing.
- [Fail-safe by design](/flock/docs/metrics-reporter/concepts/fail-safe-design/) explains why a bad TLS setting cannot stop a broker.