# Sentry

> Connect your Sentry organisation to Tidal Control with a read-only internal integration token, so compliance tests read its real configuration. Read-only.

Source: https://tidalcontrol.com/docs/integrations/sentry

Tidal Control's Sentry integration reads the configuration of your Sentry organisation for compliance purposes. It authenticates with a bearer auth token against the Sentry Web API v0 (`https://sentry.io/api/0`), and because Sentry receives production error payloads, its privacy and access settings are squarely in audit scope.

## What this integration monitors

- **Organisation access:** MFA enforcement, SSO presence, open membership, member invite permissions and the default member role
- **Members:** Per-member MFA, SSO linkage, IdP provisioning, dormant accounts and stale invitations
- **Data scrubbing:** Organisation-wide and per-project PII scrubbing, IP address scrubbing, sensitive field lists and crash report storage
- **Projects:** Owning teams, environments, public visibility, allowed domains and SSL verification
- **Client keys:** Ingestion rate limits and quota protection
- **Releases:** Commit and deploy tracking, so an error traces back to a change
- **Alerting:** Issue alert rules, detectors, workflows and cron monitors, including alerts that route nowhere

## Requirements

- Super User role in Tidal Control
- A Sentry account with access to your organisation settings
- Your Sentry **organisation slug**

> **warning:**

**An organisation auth token will not work.** Tokens created under **Settings > Developer Settings > Organization Tokens** are scoped for CI and release uploads, and cannot read members or organisation settings. Create an internal integration token instead, as described below.

## Configuration step-by-step plan

We'll create an **internal integration** in Sentry, copy its token and your organisation slug, then add the connection in Tidal Control.

**Configuration steps:**

1. **Find your organisation slug**
2. **Create an internal integration token**
3. **Configure the integration in Tidal Control**

## Step 1: Find your organisation slug

- Log in to [Sentry](https://sentry.io)
- Open Settings > Organization > General Settings and copy the Organization Slug
- You can also find it in the URL: both `acme.sentry.io` and `sentry.io/organizations/acme/` use the slug `acme`
- Copy only the slug, without `https://`, `.sentry.io` or any path

## Step 2: Create an internal integration token

- In Sentry, go to **Settings > Integrations > Custom Integrations**
- Click Create New Integration, choose Internal Integration, then click Next
- Give it a name, for example `Tidal Control`
- Under Permissions, set the following entries to Read. The scope names identify the corresponding API permissions:

<table>
<thead>
<tr><th>Permission in Sentry</th><th>Access</th><th>Scope</th><th>Covers</th></tr>
</thead>
<tbody>
<tr><td>Organization</td><td>Read</td><td><code>org:read</code></td><td>Organisation settings and data scrubbing policy</td></tr>
<tr><td>Member</td><td>Read</td><td><code>member:read</code></td><td>Members, MFA status and pending invitations</td></tr>
<tr><td>Project</td><td>Read</td><td><code>project:read</code></td><td>Projects, project settings, client keys and releases</td></tr>
<tr><td>Alerts</td><td>Read</td><td><code>alerts:read</code></td><td>Alert rules, detectors, workflows and monitors</td></tr>
</tbody>
</table>

- Leave the other permissions at No Access, Continuous Integration (CI) unchecked and webhook fields empty
- Click Save Changes, then scroll to Tokens on the saved integration page
- If the token list is empty, click New Token and follow the dialog to generate one
- Copy the generated token from Tokens. Client ID and Client Secret are different values and cannot be used in the Auth token field

## Step 3: Configure the integration in Tidal Control

- Go to **Settings → Integrations** in Tidal Control
- Click the **plus icon** next to **Sentry**
- Fill in the configuration:
  - **Name:** A descriptive name, for example `Sentry`
  - **Organisation slug:** The slug from step 1
  - **Auth token:** The token from step 2, without `Bearer`, quotes or surrounding spaces
  - **API URL (self-hosted only):** Leave empty for Sentry Cloud
- Click **"Create"** to save the integration

## Configuration fields explained

The integration dialog asks for the following values:

**Name:**
- A descriptive name for this connection
- For example: `Sentry`, `Sentry Production`

**Organisation slug:**
- The short name of your organisation, as it appears in Sentry URLs
- Required

**Auth token:**
- The internal integration token from step 2
- Required, and stored as a secret

**API URL (self-hosted only):**
- Only for a self-hosted Sentry, for example `https://sentry.example.com/api/0`
- Leave empty for Sentry Cloud

> **warning:**

**Do not point the API URL at a regional host.** Sentry Cloud splits its API between a control host (`sentry.io`) and regional hosts such as `de.sentry.io`. The control host serves every endpoint this integration uses, including for an EU-region organisation. A regional host returns a bare 404 for `/integrations/`, so the connected-integrations evidence goes silently missing while everything else keeps working. Leave the field empty unless you self-host.

## Verification

The integration is working when all of the following are true:

- Settings → Integrations shows Sentry under **Configured Integrations**
- Sentry tests are available in the Tests section
- Test refresh delivers results without authentication errors

## Frequently asked questions

**Which token type do I need?**
An internal integration token, created under **Settings > Integrations > Custom Integrations**. A personal token also works. An organisation auth token does not.

**Does Tidal Control read my error data?**
No. The integration reads configuration only: organisation and project settings, members, keys, releases and alert rules. It does not read event payloads or stack traces.

**Are my client key secrets stored?**
No. The Sentry API returns a secret and a DSN secret on each client key, and the integration maps neither. Only the key's rate-limit and activity settings are kept.

**Why do both alert rules and detectors appear?**
They are two representations of the same alerting configuration, and a live organisation returns both. Neither set being empty is a problem.

## Common problems

**Tests error with an authentication failure**
- Confirm that the saved value comes from Tokens on your internal integration page, rather than Client ID, Client Secret or Organization Tokens
- Paste the complete token without `Bearer`, quotes or surrounding spaces
- If the token was revoked, create a new token on the internal integration page and update the connection before refreshing the tests

**Member MFA results look empty or incomplete**
- The token is missing the `member:read` scope. Add it in the integration's **Permissions**

**Connected integrations evidence is missing**
- The API URL points at a regional host such as `de.sentry.io`. Clear the field for Sentry Cloud

**Cron monitor tests report nothing**
- Cron monitors are gated by your Sentry plan. On a plan without them, Sentry returns no monitors

### Still can't figure it out?

Send an email to support@tidalcontrol.com, and we'll get back to you as soon as possible.

> **info:**

**Gather support info:** Note which browser you're using, exact error messages, and which steps you've already tried. This speeds up the solution considerably.