Grafana Learn
Sign in Sign up
Path

Gather the URL, credentials, and tenant ID you'll need to connect Grafana Cloud to Loki.

Estimated time: 3 min

Prepare Loki connection details

Before adding the Loki data source, gather the URL, authentication credentials, and (if applicable) tenant ID for your Loki backend. Having these ready avoids back-and-forth while filling out the data source form.

The connection URL and authentication method depend on which flavor of Loki you’re connecting to. Use the table in the next step to find the URL format for your environment.

To prepare your Loki connection details, complete the following steps:

1. Identify your Loki environment. The Loki data source supports three common environments:

  • Self-managed Loki — Loki you run yourself, typically at http://<host>:3100.
  • Grafana Cloud Logs — The fully-managed Loki backend included with Grafana Cloud.
  • Grafana Enterprise Logs (GEL) — The self-hosted enterprise logging backend.

Note: Grafana Cloud already includes a pre-configured grafanacloud-<stack>-logs data source. Add a Loki data source manually when you need to connect to a self-managed Loki instance or require a custom configuration.

2. Record the query URL for your environment:

EnvironmentURL formatExample
Self-managed Lokihttp://<host>:3100http://loki:3100
Grafana Cloud LogsCopy from the Cloud Portalhttps://logs-prod-006.grafana.net
Grafana Enterprise LogsURL of your GEL gatewayhttps://gel.example.com

For Grafana Cloud Logs, copy the exact query URL from the Loki details page in the Cloud Portal — don’t assume the https://logs-prod-<zone>.grafana.net pattern, since some stacks use nested or legacy hostnames. https://logs-prod-006.grafana.net is one example.

The default port for self-managed Loki is 3100.

3. Choose an authentication method:

  • Basic authentication — Authenticates with a username and password. Required for Grafana Cloud Logs.
  • Forward OAuth Identity — Forwards the querying user’s OAuth access token and OIDC ID token.
  • No Authentication — For Loki instances with no auth configured (typical for local or internal deployments).

If your Loki instance sits behind a reverse proxy with its own auth, match the proxy’s expected credentials.

4. Create an access token (Grafana Cloud Logs only). If you’re connecting to Grafana Cloud Logs, create a Cloud Access Policy token with the logs:read scope:

  1. In the Grafana Cloud Portal, open your stack and select Loki.
  2. Copy the URL and note the numeric instance ID — this is your username.
  3. Create an Access Policy with logs:read scope.
  4. Generate a token under the access policy; this is your password.

Important: Don’t use your Grafana login credentials. The instance ID is the username, and the access policy token is the password.

5. Record your tenant ID (multi-tenant only). If your Loki instance is multi-tenant, record your tenant ID. You’ll add it as an X-Scope-OrgID HTTP header in the Authentication section of the data source settings.

The same header must also be set on the write path (for example, in your Alloy or Promtail configuration) so ingested logs land in the correct tenant.

In the next milestone, you add the Loki data source in Grafana Cloud.

More to explore (optional)