---
title: "Configure authentication | Grafana Labs"
description: "Select an authentication method for the Loki data source and enter credentials."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Configure authentication

The Loki data source supports several authentication methods, including **Basic authentication**, **Forward OAuth Identity**, and **No Authentication**. Grafana Cloud Logs requires basic authentication with a Cloud Access Policy token.

To configure authentication, complete the following steps:

1. In the **Authentication** section, select an authentication method from the drop-down:
   
   - **Basic authentication** — Enter a username and password. Use this for Grafana Cloud Logs.
   - **Forward OAuth Identity** — Forward the querying user’s OAuth access token and OIDC ID token.
   - **No Authentication** — For Loki instances with no authentication configured.
2. The **User** and **Password** fields appear only after you select **Basic authentication**. In the **User** field, enter the username.
   
   For **Grafana Cloud Logs**, enter your stack’s numeric instance ID (shown in the Cloud Portal on the Loki details page). For example, enter `123456`.
   
   For self-managed Loki, enter the username configured in your reverse proxy or gateway.
   
   **Important:** Don’t use your Grafana login credentials.
3. In the **Password** field, enter the password.
   
   For **Grafana Cloud Logs**, paste a Cloud Access Policy token with the `logs:read` scope.
   
   For self-managed Loki, enter the password configured in your reverse proxy or gateway.
   
   **Security note:** Passwords and tokens are encrypted at rest by Grafana. When you create an access policy token, set an expiration date so it rotates on a schedule.

**Optional — multi-tenant Loki:** If your Loki instance is multi-tenant, expand the **HTTP Headers** subsection and add a header:

- **Header:** `X-Scope-OrgID`
- **Value:** your tenant ID

This header is required on both the query path (configured here) and the write path (configured in your Alloy or Promtail configuration) so logs land in the correct tenant.

In the next milestone, you save the data source and test the connection.

* * *

### More to explore (optional)

- [Configure the Loki data source](/docs/grafana/latest/datasources/loki/configure/)
- [Grafana Cloud access policies](/docs/grafana-cloud/account-management/authentication-and-permissions/access-policies/)
- [Loki multi-tenancy](/docs/loki/latest/operations/multi-tenancy/)