---
title: "Create the access policy and token | Grafana Labs"
description: "Create a Grafana Cloud access policy with the sigil:write and OTLP write scopes, add a token, and store it once it is shown."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Create the access policy and token

The third value you need, so the SDK can send your agent’s data to your Grafana Cloud stack, is a Grafana Cloud Access Policy Token. You set it later as `AGENTO11Y_AUTH_TOKEN`. Create an access policy with the `sigil:write` scope, add the `metrics:write`, `logs:write`, and `traces:write` scopes so the same token also serves traces and metrics in Milestone 7, then add a token to the policy.

Create the access policy with its four scopes.

1. Go to the access policy page at **Administration** > **Users and access** > **Cloud access policies**.
2. The dialog that opens closes if you click this guide, so read the fields first. Click **Create access policy** and in the dialog:
   
   - Enter a **Display name**. For example, `agento11y`.
   - Enter a **Name**. For example, `agento11y`.
   - Open **Add scope**, type `sigil:write`, and select it. `sigil:write` is listed after Agent Observability is enabled (Milestone 1).
   - Select **Write** for **metrics**, **logs**, and **traces**.
   - Click **Create**.

The new policy appears in the list with its four scopes.

Add a token to the new policy and save it.

1. The dialog that opens closes if you click this guide, so read the fields first. On the new policy, click **Add token** and, in the dialog:
   
   - Give the token a name, add an optional expiration date, and click **Create**.
   - Copy the token now and save it somewhere you can find it later, such as a notes file. You’ll enter the token value in `AGENTO11Y_AUTH_TOKEN` in the next milestone. Tokens start with `glc_`.
   - The token is shown only once. Store it securely, for example in a secret manager. If you lose it, add a new token to the policy.

The token is saved for later.