Issue Automation Credentials
A 3-step recipe with Grafana. We can help you get access.
Recipe · 3 steps
Issue Automation Credentials
with Grafana · Identity & Access Management
Provision a Grafana service account and an API token for automation.
- Create the service account. It is an identity in the current organization with its own role, so it can be audited and revoked independently of any person.
- Mint a token against the service account. The "key" returned here is the bearer credential and Grafana will not show it again — capture it into a secret store on this step or the account is useless.
- Read the service account back to confirm it is enabled and the token is attached, so a broken credential is caught here rather than by the first pipeline that tries to use it.
What you'll need to have ready
- accountName: Name of the service account (e.g. "ci-dashboard-deployer").
- role: Org role for the service account; Viewer, Editor, or Admin. Prefer the least privilege the automation can do its job with.
- isDisabled: Create the account disabled. Useful when the account is provisioned ahead of the change window that turns it on.
- tokenName: Name of the token, shown in the UI and in audit logs.
- secondsToLive: Token lifetime in seconds. Omit for a token that never expires, which you should rarely want.
For your developer
Arazzo workflow grafana:issue-service-account-token, 3 operations: createServiceAccount → createToken → retrieveServiceAccount. Specs on APIs.io.