# Configure Grafana

With Grafana bound to MOI, an agent can inspect Grafana health, read data-source information, and query Prometheus metrics or Loki logs through authorized data sources.

## Prerequisites

- An available Grafana instance and permission to create a service account and token. Contact its administrator if needed.
- Permission to configure MOI tools.
- Network access from the MOI server to Grafana. Browser access does not establish server-side reachability.

## 1. Create a service account

1. In the target Grafana, open **Administration → Users and access → Service accounts**.
2. Select **Add service account**, enter a name such as `moi-monitoring`, and choose **Create**.
3. Assign the read permissions needed. Evaluate **Viewer** for read-only use instead of using a personal administrator account or granting Admin.

A service account belongs to the organization where it was created. Use separate accounts and tokens for multiple organizations. See [Grafana service accounts](https://grafana.com/docs/grafana/latest/administration/service-accounts/).

## 2. Generate a token

Open the account, select **Add service account token**, enter a token name and an expiry consistent with team requirements, and choose **Generate token**. Copy the token for the MOI form. It is not a Grafana login password.

## 3. Create the MOI instance

Open **Resource Center → Tools → Grafana** and create an instance.

| Field | Requirement | Value |
| --- | --- | --- |
| Tool instance name | Required | A name such as “Test monitoring” |
| Grafana URL | Required | For example, `https://grafana.example.com`; omit `/api`, query parameters, and embedded credentials |
| Service Account Token | Required | Raw token without a Bearer prefix |
| Description | Optional | Environment or purpose, such as test metrics and logs |
| Connection timeout (seconds) | Optional | Default 30, maximum 300 |

## 4. Save and test

Save, return to the list, and test the target instance. Use the returned error to correct the address, token, or network if needed, then test again.

## 5. Bind and validate

[Bind the tool](../bind-tools.md) and select the intended connection. Ask: “Check the test Grafana instance's health and list the names and types of accessible data sources.” Compare the call record with Grafana's data-source list. For metrics or logs, run a separate test specifying the data source and time range.

Verify a saved configuration, successful connection test, and actual correct tool result separately.

## Troubleshoot

| Symptom | Check |
| --- | --- |
| 401 | Expired, revoked, or incorrect token, including an accidental Bearer prefix |
| 403 or empty resources | Service-account organization, resource scope, and data-source permissions |
| TLS error or timeout | URL, certificate chain, and MOI server network; do not disable certificate verification |

- [Grafana service accounts](https://grafana.com/docs/grafana/latest/administration/service-accounts/)
- [All tool configuration guides](index.md)