diff --git a/apis/fluentbit/v1alpha2/plugins/output/datadog_types.go b/apis/fluentbit/v1alpha2/plugins/output/datadog_types.go
index 84f7094f9..b417dbcd6 100644
--- a/apis/fluentbit/v1alpha2/plugins/output/datadog_types.go
+++ b/apis/fluentbit/v1alpha2/plugins/output/datadog_types.go
@@ -21,7 +21,7 @@ type DataDog struct {
 	// Datadog supports and recommends setting this to gzip.
 	Compress string `json:"compress,omitempty"`
 	// Your Datadog API key.
-	APIKey string `json:"apikey,omitempty"`
+	APIKey *plugins.Secret `json:"apikey,omitempty"`
 	// Specify an HTTP Proxy.
 	Proxy string `json:"proxy,omitempty"`
 	// To activate the remapping, specify configuration flag provider.
@@ -61,8 +61,12 @@ func (s *DataDog) Params(sl plugins.SecretLoader) (*params.KVs, error) {
 	if s.Compress != "" {
 		kvs.Insert("compress", s.Compress)
 	}
-	if s.APIKey != "" {
-		kvs.Insert("apikey", s.APIKey)
+	if s.APIKey != nil {
+		apiKey, err := sl.LoadSecret(*s.APIKey)
+		if err != nil {
+			return nil, err
+		}
+		kvs.Insert("apikey", apiKey)
 	}
 	if s.Proxy != "" {
 		kvs.Insert("proxy", s.Proxy)
diff --git a/apis/fluentbit/v1alpha2/plugins/output/datadog_types_test.go b/apis/fluentbit/v1alpha2/plugins/output/datadog_types_test.go
index 648e4eaab..b68a70482 100644
--- a/apis/fluentbit/v1alpha2/plugins/output/datadog_types_test.go
+++ b/apis/fluentbit/v1alpha2/plugins/output/datadog_types_test.go
@@ -15,7 +15,6 @@ func TestOutput_DataDog_Params(t *testing.T) {
 
 	dd := DataDog{
 		Host:          "http-intake.logs.datadoghq.com",
-		APIKey:        "1234apikey",
 		TLS:           ptrBool(true),
 		Compress:      "gzip",
 		Service:       "service_name",
@@ -31,7 +30,6 @@ func TestOutput_DataDog_Params(t *testing.T) {
 	expected.Insert("Host", "http-intake.logs.datadoghq.com")
 	expected.Insert("TLS", "true")
 	expected.Insert("compress", "gzip")
-	expected.Insert("apikey", "1234apikey")
 	expected.Insert("json_date_key", "timestamp")
 	expected.Insert("include_tag_key", "true")
 	expected.Insert("tag_key", "tagkey")