---
title: "Metrics settings"
summary: "Settings for the Prometheus scrape endpoint at /metrics."
description: "The Prometheus endpoint's token and whether it is public."
status: preview
generated: true
read_when:
  - "You are scraping Pitot's own metrics."
---

Every setting below is read once at startup and requires a restart to change.
Built-in defaults are overridden by nonempty environment values.
For the first Pitot alpha, unset `PITOT_` variables accept `FANOUT_` equivalents with a names-only deprecation warning. Explicitly empty primary variables block fallback.
Unknown `PITOT_` names fail startup; platform-injected service names are tolerated.
Vendor credentials and endpoints keep the vendor's documented names.

| Environment variable | Type | Default |
|---|---|---|
| `PITOT_METRICS_PUBLIC` | boolean | `false` |
| `PITOT_METRICS_TOKEN` or `PITOT_METRICS_TOKEN_FILE` | string · secret | — |

## Notes

### `PITOT_METRICS_PUBLIC`

Allows unauthenticated Prometheus scrapes.

### `PITOT_METRICS_TOKEN`

Authorizes Prometheus scrapes with a bearer token; optional when using an admin session.

> **Secrets**
>
> Settings marked `secret` are redacted from Pitot's startup configuration
> log. Supply either the value or its `_FILE` path, never both. File contents
> lose exactly one trailing newline (LF or CRLF); empty secrets fail startup.