diff --git a/.chloggen/deprecate_access_token_passthrough.yaml b/.chloggen/deprecate_access_token_passthrough.yaml
new file mode 100644
index 000000000000..d953ffb3a918
--- /dev/null
+++ b/.chloggen/deprecate_access_token_passthrough.yaml
@@ -0,0 +1,33 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: deprecation
+
+# The name of the component, or a single word describing the area of concern, (e.g. filelogreceiver)
+component: sapmreceiver
+
+# A brief description of the change. Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: "`access_token_passthrough` is deprecated"
+
+# Mandatory: One or more tracking issues related to the change. You can use the PR number here if no issue exists.
+issues: [35330]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext: |
+  - "`access_token_passthrough` is deprecated."
+  - "Please enable include_metadata in the receiver and add the following config to the batch processor:"
+  ```yaml
+  batch:
+    metadata_keys: [X-Sf-Token]
+  ```
+
+# If your change doesn't affect end users or the exported elements of any package,
+# you should instead start your pull request title with [chore] or use the "Skip Changelog" label.
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [user]
\ No newline at end of file
diff --git a/receiver/sapmreceiver/config.go b/receiver/sapmreceiver/config.go
index 689c8a3399b8..7f0085545fef 100644
--- a/receiver/sapmreceiver/config.go
+++ b/receiver/sapmreceiver/config.go
@@ -13,5 +13,9 @@ import (
 type Config struct {
 	confighttp.ServerConfig `mapstructure:",squash"` // squash ensures fields are correctly decoded in embedded struct
 
+	// Deprecated: `access_token_passthrough` is deprecated.
+	// Please enable include_metadata in the receiver and add the following config to the batch processor:
+	// batch:
+	// 	 metadata_keys: [X-Sf-Token]
 	splunk.AccessTokenPassthroughConfig `mapstructure:",squash"`
 }
diff --git a/receiver/sapmreceiver/trace_receiver.go b/receiver/sapmreceiver/trace_receiver.go
index 4fb7e4deae13..59170b58d237 100644
--- a/receiver/sapmreceiver/trace_receiver.go
+++ b/receiver/sapmreceiver/trace_receiver.go
@@ -208,6 +208,15 @@ func newReceiver(
 	if err != nil {
 		return nil, fmt.Errorf("failed to marshal default response body for %v receiver: %w", params.ID, err)
 	}
+
+	if config.AccessTokenPassthrough {
+		params.Logger.Warn(
+			"access_token_passthrough is deprecated. " +
+				"Please enable include_metadata in the receiver and add " +
+				"`metadata_keys: [X-Sf-Token]` to the batch processor",
+		)
+	}
+
 	transport := "http"
 	if config.TLSSetting != nil {
 		transport = "https"