Dynatrace integration using expired jwt token

monique_vanwall — Mon, 19 Jan 2026 15:49:20 GMT

after migration to SAAS , integration on alerts is failing regularly with expired token.

I got confirmation of support "To remain efficient and avoid unnecessary calls to Entra ID, Dynatrace caches the JWS token. It continues to use the cached token until the destination returns a 401 Unauthorized."

Advice :

Increase the token lifetime -> Less failures.
Edit the anomaly settings for the API-GW service to ignore 401 errors.

both of the options are not realistic : Increasing the token lifetime will not be allowed by security AND will only decrease but will keep on occurring (but less frequent)
Anomaly settings on API-GW to ignore 401 errors, would give a false view, as there might be other causes for the 401's wich we would be missing.

Anyone having same experience ? Any idea how to solve ? And why does DT not test on expiration before (re-)using the token ?

Re: Dynatrace integration using expired jwt token

t_pawlak — Wed, 21 Jan 2026 13:52:54 GMT

Hi,
i will try answer 😉

Entra ID access tokens are short-lived and can vary (often ~60–90 minutes by design).
https://office365itpros.com/2023/05/29/azure-ad-access-token-lifetime/

I think you can try one of this options:
First option is create proxy/webhook receiver.

Dynatrace → your proxy endpoint

Proxy handles Entra auth, refreshes proactively (e.g., refresh when <5 minutes left), then calls API-GW.
No security exceptions, no “ignore 401”, full control (retries, logging, idempotency).

Second option is Use Dynatrace Workflows instead of the legacy notification integration.

Workflows allow:

HTTP Request with Credential Vault, and for advanced auth:

Run JavaScript to fetch a fresh Entra token “just-in-time” and send the request.
https://docs.dynatrace.com/docs/analyze-explore-automate/workflows/default-workflow-actions/http-request-workflow-action

Why doesn’t Dynatrace check the token expiry before reuse?

tokens aren’t always safely/consistently parseable/usable as a “trustworthy expiry source” across providers,
standard integration pattern: use cached bearer → refresh on 401

topic Dynatrace integration using expired jwt token in Alerting

Dynatrace integration using expired jwt token

Re: Dynatrace integration using expired jwt token