---
title: "Create an access policy token | Grafana Labs"
description: "Learn to create an access policy token that secures the connection between Kubernetes and Grafana Cloud"
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Create an access policy token

In this milestone, you create an access policy token that safeguards against unauthorized access, ensuring a secure connection between Kubernetes and Grafana Cloud.

The generated token is added to the Helm Chart manifest that you run in your Kubernetes cluster.

An access policy token is required for Grafana Alloy to send metrics and logs to Grafana Cloud. Choose how the Helm chart authenticates to Grafana Cloud. You can create a new access policy token, use an existing token, or point the chart at a stored Kubernetes Secret that already exists in your Cluster. Refer to [Grafana Cloud Access Policies](/docs/grafana-cloud/account-management/authentication-and-permissions/access-policies/) for more information.

To create a new token:

1. Click **Create a new token**.
2. In the **Access policy token name** box, enter a name. This name helps you view and revoke the token in Grafana.com later.
3. In the **Expiration date** box, select or enter an expiration in days, or keep **No expiry**.
   
   The token uses the predefined scopes `metrics:read` and `set:alloy-data-write`.
4. Click **Create token**.

To use an existing token:

1. Click **Use an existing token**.
2. Paste your token into the box.

To use a stored Kubernetes Secret:

1. Click **Use a stored Kubernetes Secret**.
2. In the **Secret name** box, enter the name of the Secret that already exists in your Cluster.
3. In the **Namespace** box, keep the installation namespace or enter the namespace that holds the Secret.
4. Optionally, expand the advanced options to change the **Username key** and **Password key** if your Secret doesn’t use the default keys `username` and `password`.
   
   The Secret must hold your Grafana Cloud instance ID as the username and an access policy token as the password, with the `metrics:read` and `set:alloy-data-write` scopes. The configuration page provides a `kubectl` command, prefilled with your instance ID, that you can copy to create the Secret. Because the chart reads the token from the Secret at runtime, your token isn’t stored in Grafana and doesn’t appear in the generated Helm command.
5. Click **Next**.