Tempo

Connecting Tempo to NeuBird makes your distributed traces available to investigations.

NeuBird queries Tempo’s HTTP API directly and authenticates with HTTP Basic.

Prerequisites

A reachable Tempo query endpoint, and a dedicated credential for NeuBird with read access to it.

Tempo has no built-in user management, so authentication usually comes from whatever fronts it — a reverse proxy, vmauth, an ingress with basic auth, or a gateway. Create a credential specifically for NeuBird rather than reusing an operator login. A dedicated credential keeps NeuBird’s access to reads only, makes its queries identifiable in your access logs, and lets you revoke it without disturbing anyone else.

If Tempo is only reachable inside your network, use the Teleport Application tab instead of exposing it.

Step 1: Build the Auth Token

The Auth Token field is not a token in the usual sense. It is the base64 encoding of username:password — the part of an HTTP Basic header that follows the word Basic. NeuBird sends it verbatim:

Authorization: Basic <your Auth Token>

Generate it from your credentials:

printf '%s' 'USERNAME:PASSWORD' | base64

Paste the whole output as the Auth Token, without the word Basic.

Caution

Base64 is encoding, not encryption. The Auth Token is your password, one base64 -d away from plain text, so treat it exactly as you would the password itself: never paste it into a ticket, a chat message, or a screenshot. Rotate the credential if the token is exposed.

Leave Auth Token blank if the endpoint needs no authentication.

Step 2: Determine the Endpoint

Use the base URL of Tempo’s query API, including any route prefix your proxy requires. NeuBird appends the API paths it needs.

https://tempo.example.com

Tempo’s HTTP API listens on port 3200 by default, so a direct deployment is often http://tempo.example.com:3200. Confirm the endpoint answers before configuring the connection:

curl -u 'USERNAME:PASSWORD' https://tempo.example.com/api/echo

That returns echo on a healthy Tempo.

Step 3: Add the Connection in NeuBird

1. In NeuBird, go to Settings > Connections and click Add Connection.
2. Select Tempo.
3. Enter a Name and, optionally, a Description.
4. Choose the authentication tab:
   • Direct Access — NeuBird reaches Tempo over the network. Fill in Tempo Endpoint and Auth Token.
   • Teleport Application — Tempo is published as a Teleport application. Fill in the same two fields, plus the Teleport fields below.
5. Click Save.

Connection Fields

Field	Required	Description
Name	Yes	A descriptive name for this connection
Description	No	Optional note about what this connection is for
Tempo Endpoint	Yes	Base URL of Tempo’s query API, e.g. https://tempo.example.com
Auth Token	No	Base64 of username:password. Leave blank if the endpoint needs no auth

Teleport Application fields

Field	Required	Description
Teleport Proxy URL	Yes	The Teleport proxy server URL, e.g. teleport.example.com:443
Bot Join Token	Yes	Machine ID bot token for tbot
Teleport App Name	Yes	Must match the Teleport application name for this service

Troubleshooting

Symptom	Likely cause
401 on validation	The Auth Token is not base64 of username:password, or the credential lacks read access
Connection times out	The endpoint is not reachable from NeuBird. Use the Teleport Application tab for private Tempo
404 on validation	The endpoint is missing a route prefix your proxy requires, or points at Tempo’s ingest port
Validation succeeds but no traces appear	Tempo holds no traces for the queried time range

---

For general instructions on creating and managing connections, see the Connections Overview.