Slide 3 of 8

Access tokens and policies

Access tokens

Access tokens allow collectors to authenticate with Fleet Management. You’ll create one and add it to your collector configuration.

How it works

ConceptWhat it is
Access policyDefines what read/write permissions a token has
Access tokenThe credential generated from a policy

Required scopes

ScopePurpose
set:alloy-data-writeLets Alloy collectors register, report health, and receive remote configurations
set:otel-data-writeLets OpenTelemetry collectors register, report health, and receive remote configurations

Where the token goes

remotecfg {
    url = "https://fleet-management-<CLUSTER>.grafana.net/"
    basic_auth {
        username = "<INSTANCE_ID>"
        password = "<YOUR_ACCESS_TOKEN>"  // ← token goes here
    }
}

In the learning path, you’ll create an access token and use it to register your Alloy collector.

Script

Before you can register a collector with Fleet Management, you need an access token. This is how the collector proves it’s allowed to connect to your Grafana Cloud account.

An access policy defines what permissions a token has: what it can read, what it can write, what services it can access. An access token is a credential generated from that policy. Think of it like a keycard—the policy says “this card opens the Fleet Management door,” and the token is the actual card you carry.

For Fleet Management, you’ll create an access policy with the “set:alloy-data-write” or “set:otel-data-write” scopes. These permissions let the collector register itself, report health data, and receive remote configurations. Then you’ll generate a token from that policy.

You’ll add this token to the remotecfg block in your configuration. When the collector starts, it uses the token to authenticate with Fleet Management and register itself in your inventory.

In the learning path, you’ll create this token and use it to register an Alloy collector. For now, just understand that access tokens are how collectors securely connect to Fleet Management.

Previous Next