# Grafana


> Grafana connects with a service account token rather than OAuth. Creating one, and why the Viewer role is the right choice.
Grafana has no OAuth flow for this, so you create a token in Grafana and paste it into Screenly along with your Grafana URL.

That difference is worth understanding rather than working around: the token is a credential you control, revocable in Grafana without touching Screenly.

## Creating the token

In Grafana, signed in as an administrator:

1. Go to **Administration**, then **Users and access**, then **Service accounts**.
2. Choose **Add service account**.
3. Name it something identifiable, such as `Screenly Integration`.
4. Set its role to **Viewer**.
5. Choose **Add service account token**, then **Generate token**.
6. Copy the token. Grafana shows it once.

Then in Screenly, under **Settings**, **Integrations**, paste the token and your Grafana URL.

## Why Viewer

A signage integration reads dashboards. It never needs to create, edit, or delete one.

Giving it **Viewer** means a leaked token cannot change anything in Grafana, and an accidental misconfiguration cannot either. Editor or Admin buys you nothing here and costs you that safety.

## Reaching your Grafana

Screenly has to be able to reach the URL you give it. A Grafana behind your firewall with no public address will not connect.

Two routes if that is your situation. Expose the specific Grafana host, or put the screens on your network with [Tailscale](/docs/integrations/network/private-network-access/) and point them at a dashboard URL as a [web page](/docs/content/web-pages/) rather than using the integration.

## Rotating and revoking

Delete the service account token in Grafana and the connection stops working immediately, wherever it was used. That is the fast way to cut access without touching Screenly.

To rotate, generate a new token and paste it in. Nothing else needs reconfiguring.