Grafana Learn
Sign in Sign up
Path

Select an authentication method for the Tempo data source and enter credentials.

Estimated time: 2 min

Configure authentication

The Tempo data source supports three authentication methods: Basic authentication, Forward OAuth Identity, and No Authentication. Grafana Cloud Traces requires basic authentication with a Cloud Access Policy token.

To configure authentication, complete the following steps:

  1. In the Authentication section, select an authentication method from the drop-down:

    • Basic authentication — Enter a username and password. Use this for Grafana Cloud Traces.
    • Forward OAuth Identity — Forward the querying user’s OAuth access token and OIDC ID token.
    • No Authentication — For Tempo instances with no authentication configured.

  2. For Basic authentication: in the User field, enter the username.

    For Grafana Cloud Traces, enter your stack’s numeric instance ID (shown in the Cloud Portal on the Tempo details page). For example, enter 123456.

    For self-managed Tempo, enter the username configured in your Tempo server block or reverse proxy.

    Important: Don’t use your Grafana login credentials.

  3. In the Password field, enter the password.

    For Grafana Cloud Traces, paste a Cloud Access Policy token with the traces:read scope.

    For self-managed Tempo, enter the password configured in your Tempo server block or reverse proxy.

    Security note: Passwords and tokens are encrypted at rest by Grafana. Rotate access policy tokens periodically.

  4. Optional — multi-tenant Tempo: If your Tempo instance is multi-tenant, expand the HTTP Headers subsection and add a header:

    • Header: X-Scope-OrgID
    • Value: your tenant ID

    This header is required on both the query path (configured here) and the write path (configured in your Alloy or OpenTelemetry Collector) so traces land in the correct tenant.

In the next milestone, you save the data source and test the connection.

More to explore (optional)