Grafana Loki Authentication

generated: '2026-08-27'
method: searched
source: https://grafana.com/docs/loki/latest/reference/loki-http-api/
name: Grafana Loki authentication
description: >-
  Grafana Loki deliberately ships no authentication. The Loki HTTP API reference states plainly:
  "authorization is not part of the Loki API. Authorization needs to be done separately, for example,
  using an open-source load-balancer such as NGINX." What Loki does carry natively is tenancy — the
  X-Scope-OrgID header — which is an isolation boundary, not a credential. Authentication is supplied
  by whatever fronts Loki: a reverse proxy for self-hosted deployments, HTTP Basic with an access
  policy token for Grafana Cloud Logs and Grafana Enterprise Logs, and OAuth 2.1 for the hosted
  Grafana Cloud MCP server.
native_auth: false
native_auth_statement: >-
  "Note that authorization is not part of the Loki API. Authorization needs to be done separately,
  for example, using an open-source load-balancer such as NGINX." —
  https://grafana.com/docs/loki/latest/reference/loki-http-api/
schemes:
  - id: tenant-header
    type: apiKey
    in: header
    name: X-Scope-OrgID
    is_credential: false
    surface: Loki HTTP API (self-hosted, multi-tenant mode)
    description: >-
      Identifies the tenant whose data is being written or read when Loki runs with auth_enabled:
      true. Multiple tenants may be queried at once by pipe-separating them
      (X-Scope-OrgID: Tenant1|Tenant2|Tenant3). This header is an identifier, not a secret — Loki
      trusts it, which is why an authenticating proxy must sit in front and set it.
    docs: https://grafana.com/docs/loki/latest/operations/multi-tenancy/
  - id: basic-access-policy-token
    type: http
    scheme: basic
    surface: Grafana Cloud Logs / Grafana Enterprise Logs
    description: >-
      HTTP Basic authentication where the username is the tenant name (pipe-separated for multiple
      tenants) and the password is an access policy token. Access policies carry scopes such as
      logs:write, logs:read and logs:delete; the deletion endpoints require a token whose access
      policy holds logs:delete for the named tenant.
    scopes_referenced: [logs:read, logs:write, logs:delete]
    docs: https://grafana.com/docs/loki/latest/reference/loki-http-api/
  - id: bearer-token
    type: http
    scheme: bearer
    surface: Loki behind an authenticating proxy
    description: >-
      logcli sends an Authorization header when LOKI_BEARER_TOKEN or LOKI_BEARER_TOKEN_FILE is set,
      which is the supported path when Loki sits behind a proxy that validates bearer tokens.
    docs: https://grafana.com/docs/loki/latest/query/logcli/getting-started/
  - id: mtls
    type: mutualTLS
    surface: Loki HTTP API (client certificates)
    description: >-
      logcli accepts --cert / --key (LOKI_CLIENT_CERT_PATH, LOKI_CLIENT_KEY_PATH) and --ca-cert
      (LOKI_CA_CERT_PATH), so client-certificate authentication against a TLS-terminating proxy is a
      first-class supported path.
    docs: https://grafana.com/docs/loki/latest/query/logcli/getting-started/
  - id: mcp-oauth
    type: oauth2
    surface: Grafana Cloud MCP server (https://mcp.grafana.com/mcp)
    description: >-
      OAuth 2.1 authorization code with PKCE (S256) and dynamic client registration. Scopes
      grafana:read, grafana:query and grafana:write. Metadata published anonymously at
      /.well-known/oauth-authorization-server (RFC 8414) and /.well-known/oauth-protected-resource
      (RFC 9728).
    authorization_endpoint: https://mcp.grafana.com/mcp/oauth/authorize
    token_endpoint: https://mcp.grafana.com/mcp/oauth/token
    registration_endpoint: https://mcp.grafana.com/mcp/oauth/register
    scopes: [grafana:read, grafana:query, grafana:write]
    docs: https://grafana.com/docs/grafana-cloud/ai-tools/mcp-servers/cloud-mcp/
  - id: service-account-token
    type: apiKey
    in: header
    name: Authorization
    surface: grafana/mcp-grafana (open source MCP server)
    description: >-
      The open-source Grafana MCP server authenticates to Grafana with a service account token
      supplied as GRAFANA_SERVICE_ACCOUNT_TOKEN alongside GRAFANA_URL. An optional caller-auth token
      (MCP_GRAFANA_SERVER_TOKEN) gates clients of the MCP listener itself.
    docs: https://github.com/grafana/mcp-grafana
scheme_count: 6
environment_variables:
  - {name: LOKI_ADDR, purpose: Loki base address for logcli}
  - {name: LOKI_USERNAME, purpose: HTTP Basic username}
  - {name: LOKI_PASSWORD, purpose: HTTP Basic password / access policy token}
  - {name: LOKI_ORG_ID, purpose: sets X-Scope-OrgID}
  - {name: LOKI_BEARER_TOKEN, purpose: Authorization bearer token}
  - {name: LOKI_BEARER_TOKEN_FILE, purpose: file containing the bearer token}
  - {name: LOKI_CLIENT_CERT_PATH, purpose: client certificate for mTLS}
  - {name: LOKI_CLIENT_KEY_PATH, purpose: client key for mTLS}
  - {name: LOKI_CA_CERT_PATH, purpose: server CA certificate}
agent_note: >-
  An agent must not assume a self-hosted Loki is protected. A Loki exposed without a fronting proxy
  accepts unauthenticated reads and writes for any tenant it is asked for, which is the single most
  important operational fact about this API.
docs:
  - https://grafana.com/docs/loki/latest/reference/loki-http-api/
  - https://grafana.com/docs/loki/latest/operations/authentication/
  - https://grafana.com/docs/loki/latest/operations/multi-tenancy/
checked: '2026-08-27'