---
title: "Prepare Loki connection details | Grafana Labs"
description: "Gather the URL, credentials, and tenant ID you'll need to connect Grafana Cloud to Loki."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Prepare Loki connection details

Before adding the Loki data source, gather the URL, authentication credentials, and (if applicable) tenant ID for your Loki backend. Having these ready avoids back-and-forth while filling out the data source form.

The connection URL and authentication method depend on which flavor of Loki you’re connecting to. Use the table in the next step to find the URL format for your environment.

To prepare your Loki connection details, complete the following steps:

**1. Identify your Loki environment.** The Loki data source supports three common environments:

- **Self-managed Loki** — Loki you run yourself, typically at `http://<host>:3100`.
- **Grafana Cloud Logs** — The fully-managed Loki backend included with Grafana Cloud.
- **Grafana Enterprise Logs (GEL)** — The self-hosted enterprise logging backend.

**Note:** Grafana Cloud already includes a pre-configured `grafanacloud-<stack>-logs` data source. Add a Loki data source manually when you need to connect to a self-managed Loki instance or require a custom configuration.

**2. Record the query URL for your environment:**

Expand table

| Environment             | URL format                 | Example                             |
|-------------------------|----------------------------|-------------------------------------|
| Self-managed Loki       | `http://<host>:3100`       | `http://loki:3100`                  |
| Grafana Cloud Logs      | Copy from the Cloud Portal | `https://logs-prod-006.grafana.net` |
| Grafana Enterprise Logs | URL of your GEL gateway    | `https://gel.example.com`           |

For **Grafana Cloud Logs**, copy the exact query URL from the Loki details page in the Cloud Portal — don’t assume the `https://logs-prod-<zone>.grafana.net` pattern, since some stacks use nested or legacy hostnames. `https://logs-prod-006.grafana.net` is one example.

The default port for self-managed Loki is `3100`.

**3. Choose an authentication method:**

- **Basic authentication** — Authenticates with a username and password. Required for Grafana Cloud Logs.
- **Forward OAuth Identity** — Forwards the querying user’s OAuth access token and OIDC ID token.
- **No Authentication** — For Loki instances with no auth configured (typical for local or internal deployments).

If your Loki instance sits behind a reverse proxy with its own auth, match the proxy’s expected credentials.

**4. Create an access token (Grafana Cloud Logs only).** If you’re connecting to **Grafana Cloud Logs**, create a Cloud Access Policy token with the `logs:read` scope:

1. In the Grafana Cloud Portal, open your stack and select **Loki**.
2. Copy the URL and note the numeric **instance ID** — this is your username.
3. Create an **Access Policy** with `logs:read` scope.
4. Generate a **token** under the access policy; this is your password.

**Important:** Don’t use your Grafana login credentials. The instance ID is the username, and the access policy token is the password.

**5. Record your tenant ID (multi-tenant only).** If your Loki instance is multi-tenant, record your tenant ID. You’ll add it as an `X-Scope-OrgID` HTTP header in the Authentication section of the data source settings.

The same header must also be set on the write path (for example, in your Alloy or Promtail configuration) so ingested logs land in the correct tenant.

In the next milestone, you add the Loki data source in Grafana Cloud.

* * *

### More to explore (optional)

- [Grafana Cloud access policies](/docs/grafana-cloud/account-management/authentication-and-permissions/access-policies/)
- [Loki multi-tenancy](/docs/loki/latest/operations/multi-tenancy/)
- [Private data source connections](/docs/grafana-cloud/connect-externally-hosted/private-data-source-connect/)