---
title: "Access tokens and policies | Grafana Labs"
description: "Understanding how collectors authenticate with Fleet Management"
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

## Access tokens

**Access tokens** allow collectors to authenticate with Fleet Management. You’ll create one and add it to your collector configuration.

## How it works

An **access policy** defines what a token can do: what it can read, what it can write, and which services it can access. An **access token** is a credential generated from that policy.

Think of it like a keycard. The policy says “this card opens the Fleet Management door,” and the token is the actual card the collector carries.

To connect a collector, you create an access policy with the right scopes, generate a token from it, and add that token to the local configuration of the collector or OpAMP Supervisor. When the collector starts, it uses the token to authenticate with Fleet Management and register itself in your inventory.

## Required scopes

| Scope                  | Purpose                                                                                  |
|------------------------|------------------------------------------------------------------------------------------|
| `set:alloy-data-write` | Lets Alloy collectors register, report health, and receive remote configurations         |
| `set:otel-data-write`  | Lets OpenTelemetry collectors register, report health, and receive remote configurations |

## Where the token goes

![Copy code to clipboard](/media/images/icons/icon-copy-small-2.svg) Copy

```none
remotecfg {
    url = "https://fleet-management-<CLUSTER>.grafana.net/"
    basic_auth {
        username = "<INSTANCE_ID>"
        password = "<YOUR_ACCESS_TOKEN>"  // ← token goes here
    }
}
```

> In the learning path, you’ll create an access token and use it to register your Alloy collector.