Loki

Go to Connections, click Connect next to Grafana Loki, and choose your deployment type:

Deployment	Credentials
Grafana Cloud	Loki URL, instance ID, and an access policy token
Self-hosted (basic auth)	Loki URL, username, password, and an optional organization ID
Self-hosted (bearer token)	Loki URL and API token

Permissions

On Grafana Cloud, the access policy token needs the logs:read scope. Self-hosted Loki needs read access to the tenant.

Read log streams for the configured tenant.

Scope	Used for
`logs:read`	Grafana Cloud access policy scope for querying logs

Permission catalog version 2026-10-16.1. See permission changes.

Log streams by label, service, and time range, plus the surrounding lines around an error. A typical query:

{service="api-gateway"} |= "error" | json | status >= 500