Grafana Learn
Sign in Sign up
Path

Gather the URL, credentials, and tenant ID you'll need to connect Grafana Cloud to Tempo.

Estimated time: 3 min

Prepare Tempo connection details

Before adding the Tempo data source, gather the URL, authentication credentials, and (if applicable) tenant ID for your Tempo backend. Having these ready avoids back-and-forth while filling out the data source form.

The connection URL and authentication method depend on which flavor of Tempo you’re connecting to. Use the table in the next step to find the URL format for your environment.

To prepare your Tempo connection details, complete the following steps:

1. Identify your Tempo environment. The Tempo data source supports three common environments:

  • Self-managed Tempo — Tempo you run yourself, typically at http://<host>:<port>.
  • Grafana Cloud Traces — The fully-managed Tempo backend included with Grafana Cloud.
  • Grafana Enterprise Traces (GET) — The self-hosted enterprise tracing backend.

Note: Grafana Cloud already includes a pre-configured grafanacloud-<stack>-traces data source. Add a Tempo data source manually when you need to connect to a self-managed Tempo instance or require a custom configuration.

2. Record the query URL for your environment:

EnvironmentURL formatExample
Self-managed Tempo (HTTP)http://<host>:3200http://tempo:3200
Grafana Cloud Traceshttps://tempo-<zone>.grafana.net/tempohttps://tempo-prod-01-eu-west-0.grafana.net/tempo
Grafana Enterprise TracesURL of your GET gatewayhttps://get.example.com/tempo

The default port for self-managed Tempo is 3200 for HTTP and 9095 for gRPC.

3. Choose an authentication method:

  • Basic authentication — Authenticates with a username and password. Required for Grafana Cloud Traces.
  • Forward OAuth Identity — Forwards the querying user’s OAuth access token and OIDC ID token.
  • No Authentication — For Tempo instances with no auth configured (typical for local or internal deployments).

If your Tempo instance sits behind a reverse proxy with its own auth, match the proxy’s expected credentials.

4. Create an access token (Grafana Cloud Traces only). If you’re connecting to Grafana Cloud Traces, create a Cloud Access Policy token with the traces:read scope:

  1. In the Grafana Cloud Portal, open your stack and select Tempo.
  2. Copy the URL and note the numeric instance ID — this is your username.
  3. Create an Access Policy with traces:read scope.
  4. Generate a token under the access policy; this is your password.

Important: Don’t use your Grafana login credentials. The instance ID is the username, and the access policy token is the password.

5. Record your tenant ID (multi-tenant only). If your Tempo instance is multi-tenant, record your tenant ID. You’ll add it as an X-Scope-OrgID HTTP header in the Authentication section of the data source settings.

The same header must also be set on the write path (for example, in your Alloy or OpenTelemetry Collector configuration) so ingested traces land in the correct tenant.

In the next milestone, you add the Tempo data source in Grafana Cloud.

More to explore (optional)