# Connect Sentry

Canonical URL: https://docs.fuse.init.inc/integrations/sentry/setup

Create a Sentry auth token and submit region, organization, and token fields to Init.



## Before you start [#before-you-start]

Sentry uses **customer bearer credentials**. There is no Init platform OAuth app for this provider.

**Connection admin/user** creates an auth token in Sentry and submits it with the organization slug and cloud region.

You need:

* Membership in the Sentry organization with permission to create organization or user auth tokens.
* The organization slug (from the Sentry URL or organization settings).
* The organization’s data storage region (`us`, `us2`, `de`, or legacy `sentry.io` hosting).

## Configure the provider [#configure-the-provider]

### Create an auth token (**Connection admin/user**) [#create-an-auth-token-connection-adminuser]

1. In Sentry, open organization **Settings → Auth Tokens** (organization token) or **User settings → Personal Tokens** when a user token is required.
2. Create a token with only the scopes needed for the Init actions you will run (for example `org:read`, `project:read`, `event:read`). Avoid admin scopes unless required.
3. Copy the token once and store it securely.
4. Confirm the organization slug and region on the organization settings page.

* US → `us` (`us.sentry.io`)
* US2 → `us2` (`us2.sentry.io`)
* DE/EU → `de` (`de.sentry.io`)
* Legacy global host → `legacy` (`sentry.io`)

There is no platform Sentry client registration for Init.

## Connect to Init [#connect-to-init]

**Connection admin/user** starts a Sentry Connect session and submits:

| Field               | Required | Notes                               |
| ------------------- | -------- | ----------------------------------- |
| `access_token`      | Yes      | Sentry bearer auth token.           |
| `cloud_region`      | Yes      | One of `us`, `us2`, `de`, `legacy`. |
| `organization_slug` | Yes      | URL slug for the organization.      |

Use `example-token-not-valid` only as an inert documentation placeholder. Never paste a live token into docs.

## Permissions [#permissions]

Token scopes control API access. Match scopes to the generated action requirements; do not grant `org:admin` or similar unless an action truly needs it.

The token must be valid for the selected `organization_slug`. Region mismatches send API calls to the wrong Sentry host even when the token string is valid.

## Verify the connection [#verify-the-connection]

1. Complete Connect and confirm the connection is active.
2. Run Init’s connection test or a safe read such as listing projects for the organization.
3. Success looks like Sentry returning organization/project data from the selected regional host without `401`/`403`.

## Rotate or revoke access [#rotate-or-revoke-access]

1. Create a new auth token with the same least-privilege scopes.
2. Reconnect in Init with the new `access_token` (keep the same `cloud_region` and `organization_slug` unless the org moved—region moves require a new org).
3. Revoke the previous token in Sentry.

If a token is exposed, revoke it immediately, then reconnect.

## Troubleshooting [#troubleshooting]

| Symptom                                | What to check                                                          |
| -------------------------------------- | ---------------------------------------------------------------------- |
| `401` Unauthorized                     | Token revoked, mistyped, or wrong token type for the endpoint.         |
| `404` / empty org                      | `organization_slug` does not match the org the token can access.       |
| Unexpected latency or wrong data plane | `cloud_region` does not match the org’s storage location.              |
| Scope errors                           | Token scopes missing for the action; create a new token and reconnect. |
| Connect rejects region                 | Use only `us`, `us2`, `de`, or `legacy`.                               |