Authentication

Authentication methods for the Grafana API

Authentication API

The Grafana API supports multiple authentication methods for secure access to API endpoints.

Authentication Methods

Grafana supports the following authentication methods:

1. Basic Authentication - Username and password
2. API Keys - Token-based authentication
3. Session Cookies - Browser-based authentication

Basic Authentication

Use HTTP Basic Authentication with your Grafana username and password:

curl -u admin:admin http://localhost:3000/api/org

Security Definitions

basic · basic

HTTP Basic Authentication using username and password

API Key Authentication

API keys provide a secure way to authenticate API requests without exposing user credentials.

Security Definitions

api_key · apiKey

API Key authentication

Location: Header
Name: Authorization
Format: Bearer <api-key>

Using API Keys

Include the API key in the Authorization header:

curl -H "Authorization: Bearer eyJrIjoiT0tTcG1pUlY2RnVKZTFVaDFsNFZXdE9ZWmNrMkZYbk" \
  http://localhost:3000/api/org

Session Authentication

Login

cURL

curl -X POST http://localhost:3000/api/login \
  -H "Content-Type: application/json" \
  -d '{
    "user": "admin",
    "password": "admin"
  }'

{
  "message": "Logged in"
}

user · string · required

Username or email address

password · string · required

User password

message · string

Login success message

Logout

cURL

curl -X GET http://localhost:3000/api/logout

Logs out the current user and clears the session cookie.

User Auth Tokens

Get Auth Tokens

Get all auth tokens for the current user.

cURL

curl -X GET http://localhost:3000/api/user/auth-tokens \
  -u admin:admin

[
  {
    "id": 1,
    "isActive": true,
    "clientIp": "127.0.0.1",
    "browser": "Chrome",
    "browserVersion": "91.0",
    "os": "Linux",
    "osVersion": "",
    "device": "Other",
    "createdAt": "2021-06-01T10:00:00Z",
    "seenAt": "2021-06-01T12:00:00Z"
  }
]

id · integer

Token ID

isActive · boolean

Whether the token is currently active

clientIp · string

IP address of the client

createdAt · string

Token creation timestamp (ISO 8601)

Revoke Auth Token

Revoke a specific auth token.

cURL

curl -X POST http://localhost:3000/api/user/revoke-auth-token \
  -u admin:admin \
  -H "Content-Type: application/json" \
  -d '{
    "authTokenId": 1
  }'

{
  "message": "User auth token revoked"
}

authTokenId · integer · required

ID of the auth token to revoke

Rotate Auth Token

Rotate the current auth token.

cURL

curl -X POST http://localhost:3000/api/user/auth-tokens/rotate \
  -u admin:admin

{
  "message": "Token rotated",
  "token": "new-token-value"
}

Authentication Errors

401 Unauthorized

Returned when authentication credentials are missing or invalid.

{
  "message": "Unauthorized"
}

403 Forbidden

Returned when the authenticated user lacks permission for the requested resource.

{
  "message": "Permission denied"
}