> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Grafana

> Connect a Grafana instance to browse dashboards, alerts, and traces.

Nuphos authenticates to Grafana with a **service account token** and proxies
requests to your instance, so the agent can read your dashboards, alert rules, and
datasources, and explore traces.

## Connect

### Create a service account token

In Grafana, under **Administration → Service accounts**, create a service account
and add a **token** to it. Copy the token (it's shown once; depending on your
Grafana version it may start with `glsa_`).

### Connect in Nuphos

In **Connectors → Connect → Grafana**, enter:

| Field                     | Notes                                                                    |
| ------------------------- | ------------------------------------------------------------------------ |
| **Name**                  | A label, e.g. "prod" or "staging"                                        |
| **Grafana URL**           | Base URL, e.g. `https://grafana.example.com` — no trailing slash or path |
| **Service account token** | The token you created                                                    |

<Warning>
  The URL must be a public HTTPS/HTTP host. Private and loopback ranges
  (`10.0.0.0/8`, `127.0.0.0/8`, `169.254.0.0/16`, `172.16.0.0/12`,
  `192.168.0.0/16`, `localhost`) are rejected. Don't embed credentials in the URL.
</Warning>

The connection isn't verified at bind time, so if the token or URL is wrong it
fails the first time the agent uses it — double-check both.

## In the Nuphos app

Grafana's alert rules feed the unified
[Monitoring overview](/observability/monitoring) — one place to see what's
configured to fire and what's firing now, across all your observability
providers, with links back to Grafana for the full detail.

## What the agent can do for you

The agent can browse dashboards, alert rules, and datasources, and explore
traces. During an incident, that means asking things like:

* *"Which alerts are firing right now, and since when?"*
* *"Pull the latency panel for `checkout` over the last 6 hours and tell me when
  it degraded."*
* *"Follow the slow trace for this request"* — the agent walks the trace and
  correlates it with logs and deploys from your other
  [connectors](/connectors/overview) to chase the root cause.

The agent can also set up monitors and alerts for you using provider
[skills](/agent/skills), proposing a [plan](/agent/plans) when a change is
involved.

## Permissions & authorization

Two boundaries govern what happens through this connector:

* **Hard boundary — who can use it.** Only team **Administrators** can bind or
  remove the connection, and they can restrict it to specific members with a
  [member allow-list](/security/access-control). Within a session the agent only
  holds credentials you explicitly selected, re-checked on every request.
* **Soft boundary — what the agent may do with it.** Reading dashboards, alerts,
  and traces is free-form; changes go through
  [plan approvals](/security/approvals) and
  [Auto-authorization](/security/auto-mode).

The outer limit is the service account's **role in Grafana** — give it Viewer if
you only want the agent reading, and Grafana enforces it regardless of what the
agent is asked.

## Good to know

* Requests are **proxied through Nuphos** — the agent never holds your Grafana
  token directly.
* You can connect **several instances** (prod, staging) side by side; the label
  keeps them distinguishable in the app and in agent sessions.