Observability Integrations (Sentry, PostHog and New Relic)

Overview

Fencer connects to three observability platforms — Sentry, PostHog and New Relic — to show you who has access to them. Each integration syncs the platform’s organization members into Posture > Identities, so you can track those accounts alongside the rest of your organization’s identity posture and keep a unified view of user access across your SaaS tools.

Prerequisites

• An active Fencer subscription.
• The Administrator role in your Fencer organization.
• To sync identities, a Fencer plan that includes Identities.
• For Sentry: the Owner or Manager role in the Sentry organization you want to connect.
• For PostHog: a PostHog personal API key with the organization:read and organization_member:read scopes.
• For New Relic: your New Relic account ID and a User API key (it starts with NRAK-).

How it works

When you connect one of these platforms, Fencer retrieves the list of organization members from it and syncs them as vendor identities. This identity data feeds Fencer’s identity inventory, where you can correlate users across services and review access. The sync runs when you connect and again every night.

• Sentry is installed as a Sentry integration: you authorize Fencer in Sentry, and Fencer stores and refreshes the tokens Sentry issues. Fencer reads your organization details and member list, read-only.
• PostHog uses a personal API key that you generate in your PostHog account settings.
• New Relic uses a User API key. Fencer checks that the key can query the account you name.

Fencer validates the credentials before it saves any connection.

Usage / Configuration

Connecting Sentry

1. Go to Admin > Integrations.
2. Click the Sentry card under Available Integrations.
3. Read the summary, click Continue, then click Connect Sentry.
4. You are redirected to Sentry. Sign in if prompted and select the organization you want to connect.
5. Review the requested permissions — organization details and the member list, both read-only — and click Authorize.
6. You are redirected back to Fencer. The connection appears with your Sentry organization’s name, and an identity sync starts automatically.

Connecting PostHog

1. Go to Admin > Integrations.
2. Click the PostHog card under Available Integrations, then click Continue.
3. Fill in the connection form:
   • Name (optional): a label for this connection. Defaults to the PostHog organization name.
   • PostHog instance: select US Cloud (us.posthog.com), EU Cloud (eu.posthog.com) or Self-hosted.
   • Self-hosted URL: for a self-hosted instance, your instance URL (for example https://posthog.example.com).
   • Personal API key: in PostHog, click your profile picture, go to Settings, open Personal API keys and create a key with the organization:read and organization_member:read scopes.
   • PostHog organization: once you enter the key, Fencer lists the PostHog organizations it can reach. Select the one to sync.
4. Click Connect. Fencer checks the key against your PostHog instance, creates the connection and starts an identity sync.

Connecting New Relic

1. Go to Admin > Integrations.
2. Click the New Relic card under Available Integrations, then click Continue.
3. Fill in the connection form:
   • Name (optional): a label for this connection. Defaults to “New Relic”.
   • Account ID: your New Relic account ID. It is in the URL when you are signed in to one.newrelic.com, or under Administration > Access management > Accounts in New Relic.
   • User API key: in New Relic, open the user menu, go to API keys, click Create a key and choose User as the key type. The key must have query access to the account.
4. Click Connect. Fencer checks that the key can query the account, creates the connection and starts an identity sync.

Editing a connection

PostHog and New Relic connections can be edited. Sentry connections have nothing to edit.

1. Go to Admin > Integrations and find the connection.
2. Click Edit (the pencil icon).
3. Update the fields you need:
   • PostHog: Name, PostHog instance, Self-hosted URL and Personal API key. The PostHog organization is chosen when you connect and cannot be changed.
   • New Relic: Name, Account ID and User API key.
4. Leave the API key blank to keep the existing key, then click Save changes. Fencer checks the credentials again when you change the key, the account or the instance.

Disconnecting an integration

1. Go to Admin > Integrations.
2. On the connection’s card, click Remove (the trash icon), then confirm with Remove.
3. Fencer clears the stored credentials, removes the connection and removes the identities it synced from Posture > Identities.

Uninstalling the Fencer integration from your Sentry organization also disconnects it in Fencer.

Examples

Viewing synced identities from Sentry

After connecting Sentry, open Posture > Identities and select the Vendor Identities tab. Sentry members are listed with their email address, display name, role (for example admin or member), MFA status and status: Active, Pending for open invitations, or Inactive for expired invitations. These identities can be correlated with identities from your other connected platforms to build a complete picture of user access.

PostHog with a self-hosted instance

If your team runs PostHog on its own infrastructure:

1. During setup, select Self-hosted as the PostHog instance.
2. Enter your instance URL in Self-hosted URL, such as https://posthog.internal.example.com.
3. Provide a personal API key generated on that instance with the organization:read and organization_member:read scopes.
4. Fencer connects to your self-hosted PostHog API and syncs members the same way it does for the cloud-hosted version.

Troubleshooting

• “Failed to connect to Sentry. Please try again.” — Sentry did not complete the authorization. Make sure you have the Owner or Manager role in the Sentry organization and try again.
• “Unable to connect to PostHog. Please check your API key and instance URL.” — The API key may be invalid, expired, or missing the organization:read and organization_member:read scopes. For self-hosted instances, confirm that the URL is reachable from the internet.
• “Invalid API key. Please check that you have entered a valid New Relic User API key.” — Use a User key (it starts with NRAK-), not a license or browser key.
• “Access denied. Your API key does not have permission to query account …” — The New Relic key belongs to a user who cannot query that account. Check the Account ID, or create the key as a user with access to it.
• Connection shows an issue — For Sentry, click Reconnect (the refresh icon) on the connection’s card. For PostHog or New Relic, edit the connection and enter a fresh API key.
• No members synced — Make sure the connected organization or account has active members, and that the key (PostHog, New Relic) or the Sentry authorization still grants read access to them.

Related pages

• Integrations Overview
• Identity Management
• Vendor Identities