--- title: "Set up the GET plugin for Grafana | Grafana Enterprise Traces documentation" description: "Set up the GET plugin to create new tenants and roles for GET within Grafana." --- # Set up the GET plugin for Grafana The Grafana Enterprise Traces (GET) plugin lets you create new tenants and then use the access page to create new roles to publish traces. These commands are completed using the Grafana user interface in lieu of commands that would normally be completed using the GET CLI. This procedure explains how to enable and configure the GET plugin. ### Before you begin To configure the GET plugin, you need: - Grafana Enterprise 8.4.0 or higher - GET cluster access token - Microservice deployments require the GET gateway URL, for example: [http://tempo-enterprise-gateway.enterprise-traces-test.svc.cluster.local:3200](http://tempo-enterprise-gateway.enterprise-traces-test.svc.cluster.local:3200) Refer to [Deploy Grafana Enterprise on Kubernetes](/docs/grafana/latest/installation/kubernetes/#deploy-grafana-enterprise-on-kubernetes) if you are using Kubernetes. Otherwise, refer to [Install Grafana](/docs/grafana/latest/installation/) for more information. ## Install the plugin in your Grafana Enterprise instance There are multiple ways to install the plugin to your local Grafana Enterprise instance. For more information, refer to [Grafana Enterprise Traces app installation](/grafana/plugins/grafana-enterprise-traces-app/?tab=installation) (requires login). After installing the plugin, you will need to restart the Grafana pod for the plugin to be loaded on startup. If using the “Deploy Grafana Enterprise on Kubernetes” instructions, you will need to access the shell for the Grafana pod that you have just deployed to use the GET plugin installation instructions “Installing on a local Grafana”. ## Enable and configure the plugin To enable and configure the plugin: 1. Log in to Grafana Enterprise. 2. From the top-left menu, select Configuration and then select Plugins. 3. Search for Grafana Enterprise Traces plugin. This option is only available if you have GET and Grafana Enterprise licenses installed. 4. From the Connection settings tab of the plugin, enable the plugin by clicking on Enable plugin. 5. Provide the necessary API settings so that the plugin can connect to your cluster: - Access token: Enter the `admin`-scoped access token that you generated when setting up your GET cluster. This is available in the logs output (or other configured output) from the [tokengen job](/docs/enterprise-traces/latest/configure/tokengen/) for the GET installation. The token is prefixed by the text `Token:`. - Grafana Enterprise Traces URL: Enter the URL of your GET cluster. For single-process clusters, this is any node in the cluster. For microservice deployments, this URL is the GET gateway (for example, [http://tempo-enterprise-gateway.enterprise-traces-test.svc.cluster.local:3200](http://tempo-enterprise-gateway.enterprise-traces-test.svc.cluster.local:3200)). 6. Click **Test** and save configuration. 7. Navigate to Grafana Enterprise Traces (select the GET, the stylized ‘T’ icon, on the menu bar). 8. Verify that the plugin loads and can communicate with the GET admin API endpoints. You can test this by selecting the **Licenses** tab from the GET plugin and ensure that you see something like this: text ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```text Issuer: https://grafana.com Issued at: 2026-01-29 13:06:11 Expires: 2026-02-05 13:06:11 Products: grafana-enterprise-traces ``` 9. Look at the default access policy under the **Access Policies** tab and ensure that there is a default access policy for the `admin` scope. ### Configure the plugin using provisioning Alternatively, you can also manage the GET plugin using a plugin configuration. Refer to the [plugin configuration](/docs/grafana/latest/administration/provisioning/#plugins) documentation for more information. Example GET plugin configuration file: YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```yaml apiVersion: 1 apps: # the type of app, plugin identifier. Required - type: grafana-enterprise-traces-app # Org ID. Default to 1, unless org_name is specified org_id: 1 # Org name. Overrides org_id unless org_id not specified org_name: Main Org. # disable the app. Default to false. disabled: false # fields that will be converted to json and stored in jsonData. jsonData: # key/value pairs of string to object backendUrl: http://[...] # fields that will be converted to json, encrypted and stored in secureJsonData. secureJsonData: # accessToken: [...] ``` #### Optional `policiesOnly` field For a simpler user experience that only shows the **Access policies** page, you can include the following in the `jsonData` configuration: YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```yaml jsonData: policiesOnly: true ``` This simpler mode of operation only gives users access to the ability to create access policies and tokens. It requires setting up the environment to include at least one tenant. #### Optional `policiesOnly` field For a simpler user experience that only shows the “Access policies” page, you can include the following in the `jsonData` configuration: YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```yaml jsonData: policiesOnly: true ``` This simpler mode of operation only gives users access to the ability to create access policies and tokens. It requires setting up the environment to include at least one tenant. #### Legacy `base64EncodedAccessToken` field Prior to version 6.0.0 of the plugin, authentication required a `base64EncodedAccessToken` field. This has been replaced with the simpler `accessToken`. Troubleshooting for versions earlier than 6.0.0 The following is provided for troubleshooting purposes, or for users of versions earlier than 6.0.0. Moving forward, use `accessToken` in your configuration. If both `base64EncodedAccessToken` and `accessToken` are present in the `jsonData`, the `base64EncodedAccessToken` is ignored in versions 6.0.0 and later. The format of the `base64EncodedAccessToken` token is a base64-encoded representation of a user-token pair, separated by a colon. For example, `$USER:$TOKEN`. If you’ve set your GET token as the `TOKEN` environment variable, and you’ve also set a `USER` environment variable, then you can generate a compatible `base64EncodedAccessToken` token in the following format: sh ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```sh #USER INTENTIONALLY LEFT BLANK, INDICATING THE "ADMIN" USER USER= TOKEN=exampleTokenForBase64EncodedAccessToken echo $USER:$TOKEN | tr -d '[:space:]' | base64 -w0 ``` Though `$USER` is typically blank, you can opt to leave it in the expression to ensure that the `:` character is present. The following is a more direct way of obtaining the same result: sh ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```sh echo :$TOKEN | tr -d '[:space:]' | base64 -w0 ``` These examples both result in the following `base64EncodedAccessToken` string: ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```none OmV4YW1wbGVUb2tlbkZvckJhc2U2NEVuY29kZWRBY2Nlc3NUb2tlbgo= ``` You can apply the encoded token string to the configuration under `secureJsonData` in your plugin configuration file: YAML ![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy ```yaml secureJsonData: # a base64 encoding of $USER:$TOKEN base64EncodedAccessToken: OmV4YW1wbGVUb2tlbkZvckJhc2U2NEVuY29kZWRBY2Nlc3NUb2tlbgo= ``` ## Next steps Now that you have correctly configured the plugin, the next step is to [set up a GET tenant and visualize your data](/docs/enterprise-traces/latest/setup/set-up-get-tenants/). ## Limitations The GET plugin for Grafana allows to manage only 1 GET cluster, and it doesn’t support managing multiple GET clusters with a single GET plugin installation. If you need to manage multiple GET clusters, you should configure 1 GET cluster per Grafana organization.