---
title: "Configure authentication | Grafana Labs"
description: "Select an authentication method for the Tempo data source and enter credentials."
---

> For a curated documentation index, see [llms.txt](/llms.txt). For the complete documentation index, see [llms-full.txt](/llms-full.txt).

# Configure authentication

The Tempo data source supports three authentication methods: **Basic authentication**, **Forward OAuth Identity**, and **No Authentication**. Grafana Cloud Traces requires basic authentication with a Cloud Access Policy token.

To configure authentication, complete the following steps:

1. In the **Authentication** section, select an authentication method from the drop-down:
   
   - **Basic authentication** — Enter a username and password. Use this for Grafana Cloud Traces.
   - **Forward OAuth Identity** — Forward the querying user’s OAuth access token and OIDC ID token.
   - **No Authentication** — For Tempo instances with no authentication configured.
2. For **Basic authentication**: in the **User** field, enter the username.
   
   For **Grafana Cloud Traces**, enter your stack’s numeric instance ID (shown in the Cloud Portal on the Tempo details page). For example, enter `123456`.
   
   For self-managed Tempo, enter the username configured in your Tempo `server` block or reverse proxy.
   
   **Important:** Don’t use your Grafana login credentials.
3. In the **Password** field, enter the password.
   
   For **Grafana Cloud Traces**, paste a Cloud Access Policy token with the `traces:read` scope.
   
   For self-managed Tempo, enter the password configured in your Tempo `server` block or reverse proxy.
   
   **Security note:** Passwords and tokens are encrypted at rest by Grafana. Rotate access policy tokens periodically.
4. **Optional — multi-tenant Tempo:** If your Tempo instance is multi-tenant, expand the **HTTP Headers** subsection and add a header:
   
   - **Header:** `X-Scope-OrgID`
   - **Value:** your tenant ID
   
   This header is required on both the query path (configured here) and the write path (configured in your Alloy or OpenTelemetry Collector) so traces land in the correct tenant.

In the next milestone, you save the data source and test the connection.

* * *

### More to explore (optional)

- [Configure the Tempo data source: Authentication](/docs/grafana/latest/datasources/tempo/configure-tempo-data-source/#authentication)
- [Grafana Cloud access policies](/docs/grafana-cloud/account-management/authentication-and-permissions/access-policies/)
- [Tempo multi-tenancy](/docs/tempo/latest/operations/multitenancy/)