Slide 2 of 6

Access tokens and policies

Access tokens

Access tokens allow collectors to authenticate with Fleet Management. You’ll create one and add it to your collector configuration.

How it works

An access policy defines what a token can do: what it can read, what it can write, and which services it can access. An access token is a credential generated from that policy.

Think of it like a keycard. The policy says “this card opens the Fleet Management door,” and the token is the actual card the collector carries.

To connect a collector, you create an access policy with the right scopes, generate a token from it, and add that token to the local configuration of the collector or OpAMP Supervisor. When the collector starts, it uses the token to authenticate with Fleet Management and register itself in your inventory.

Required scopes

ScopePurpose
set:alloy-data-writeLets Alloy collectors register, report health, and receive remote configurations
set:otel-data-writeLets OpenTelemetry collectors register, report health, and receive remote configurations

Where the token goes

remotecfg {
    url = "https://fleet-management-<CLUSTER>.grafana.net/"
    basic_auth {
        username = "<INSTANCE_ID>"
        password = "<YOUR_ACCESS_TOKEN>"  // ← token goes here
    }
}

In the learning path, you’ll create an access token and use it to register your Alloy collector.

Script

Before you can register a collector with Fleet Management, you need an access token. This is how the collector proves it’s allowed to connect to your Grafana Cloud account.

An access policy defines what permissions a token has: what it can read, what it can write, what services it can access. An access token is a credential generated from that policy. Think of it like a keycard. The policy says “this card opens the Fleet Management door,” and the token is the actual card you carry.

For Fleet Management, you’ll create an access policy with the “set:alloy-data-write” or “set:otel-data-write” scopes. These permissions let the collector register itself, report health data, and receive remote configurations. Then you’ll generate a token from that policy.

You’ll add this token to the remotecfg block in your configuration. When the collector starts, it uses the token to authenticate with Fleet Management and register itself in your inventory.

In the learning path, you’ll create this token and use it to register an Alloy collector. For now, just understand that access tokens are how collectors securely connect to Fleet Management.

/
Previous Next