Documentation Grafana Cloud Platform Assistant Configure Pages

Configure Grafana Pages

Configure how Grafana Pages uses your external accounts, runs actions, and connects to external services. Each reader uses their own accounts and permissions. Sharing a page doesn’t share your credentials or approvals.

Before you begin

Make sure you have a Grafana Cloud stack with Pages available and access to the accounts and data sources your page uses. Pages isn’t available in self-managed Grafana.

To view Pages, you need Pages read access and permission to read its network settings. To change stack-wide network settings, you also need Pages settings write permission. To approve origins for a draft, you need write access to its conversation. For the required actions, refer to Control access to Pages.

Connect accounts

Connect your account when a page requests access to an external service. For MCP connections, refer to Configure MCP servers. Review the service and requested operation before approving access.

Read approval lets the page use a server’s read-only tools with your account until you reload Grafana. Where offered, you can save read approval. Changes require separate approval, which you can save for a specific tool when offered. Other tools still ask, and tools that require approval for every call continue to ask each time.

Approve actions

Review the destination and values before approving an action, for example, an HTTP request through an Infinity data source. If you select Always allow for this page, you allow all supported non-MCP actions from that page without further review, including requests that change external systems. MCP approvals remain separate.

Saved approvals apply to your account and that page in this browser. Other pages and readers need their own approval. Draft and published pages have separate permissions. Connection setup, account permissions, and data source policies still apply to every request.

The page must stay open to run actions. Actions can run when you switch browser tabs, but browsers can throttle background timers and page data source queries pause in hidden tabs.

To require review again, open Page actions > Permissions and click Revoke beside the grant. Clearing your browser’s saved data also removes saved approvals. Revoking approval can’t undo an action already sent.

Configure network access

Pages runs in sandboxed browser frames. Its network policy controls direct browser connections and HTTPS images, not sandbox container connections. The Grafana origin and Grafana asset CDNs are always allowed.

In Assistant, open Settings > Pages > Network access to manage destinations for every page in your stack.

1. In Allowed connection origins, enter exact HTTPS or WSS origins, one per line, for example, https://api.example.com or wss://stream.example.com:8443.
2. Click Save. When you add destinations, review them and click Allow destinations and save.

You can include a port. Don’t include wildcards, paths, query parameters, fragments, or credentials. Grafana normalizes the standard port 443.

The default allowlist includes common external services, including Google’s favicon service at https://www.google.com and its redirect origins, https://t0.gstatic.com through https://t3.gstatic.com. Changes to defaults don’t modify an allowlist you’ve already saved.

Allow origins for a single page is on by default and lets authors approve up to 20 extra origins per page. The switch saves immediately. If you turn it off, pages use only the stack-wide allowlist. Existing page origins remain stored but inactive, and authors can remove them but can’t add more.

Manage a page’s origins

Ask Assistant to add a destination when your page needs an external service. Review the origin and reason in the approval prompt, then click Approve. Each addition requires explicit approval; saved action approvals don’t bypass this review.

Approved HTTPS origins also allow images. If an image redirects, approve every origin in the chain, for example, both https://www.google.com and https://t0.gstatic.com. Scripts, stylesheets, and fonts still require a supported CDN host. Browser CORS rules and the destination’s access requirements can also block requests.

To review or remove origins, open Page actions > Network access in the authoring canvas. Click Remove beside an origin you no longer need. The canvas reloads its frames without that access. Other open viewers check for removals every 30 seconds and when the window gains focus. Newly added origins require a page reload in those viewers.

Publishing copies your draft’s origins to the shared page. Later draft changes don’t affect readers until you publish an update. Readers can inspect the published origins under Page details.

Editing a shared page starts with its published origins. Catalog imports and chat snapshots also copy origins, but a remix starts with an empty list and needs fresh approval. Restoring a published version restores its network origins too, so review them before restoring.

Next steps

• Refer to Grafana Pages to create, refine, and share pages
• Refer to Manage Assistant access with RBAC to configure permissions
• Refer to Your data and security for security requirements