How to show a private Grafana dashboard on a TV without a login screen

Method 1: share the dashboard with a link (Grafana Cloud and self-hosted)

Grafana calls this externally shared dashboards (Grafana 11 and newer) or public dashboards (Grafana 9.1 to 10). It produces a read-only URL that runs the dashboard's stored queries for anyone who has the link, with no login. It is the safest option because the screen holds no credential at all, and it is the only option on Grafana Cloud.

1. Make a copy for the wall. Open the dashboard, choose Save as copy, and name it, for example, NOC wall. Shared links do not support template variables, so in the copy replace each variable with the fixed value the wall should show. Remove panels that use frontend data sources or library panels; they render empty on a shared link.
2. Share it. Click the Share dropdown at the top of the dashboard and choose Share externally. On Grafana 10 the same option is the Public dashboard tab of the Share dialog.
3. Choose who can open it. Select Anyone with the link, tick the acknowledgement checkbox and click Accept. The Only specific people option emails one-time links that expire; it is meant for humans, not screens.
4. Set the options. Leave Enable time range off so the wall cannot be changed by whoever finds the link, and turn Display annotations on only if the wall should show them.
5. Copy the link. It looks like https://grafana.example.com/public-dashboards/8f2c…. Append ?kiosk&refresh=30s for a clean, self-refreshing view.
6. Later: Pause access stops the link temporarily and keeps the URL; Revoke access kills it for good and you must share again.

Method 2: an anonymous viewer organisation (self-hosted)

Anonymous access lets unauthenticated visitors view one organisation with a role you choose. It supports everything a normal viewer sees, including template variables, playlists and links between dashboards. It is a server setting in grafana.ini, so it is not available on Grafana Cloud, and on Grafana Enterprise anonymous devices count towards licensed users (one user per three devices).

1. Create a dedicated org. Administration → Organizations → New org, for example Wall. Anonymous visitors will see this org only, so never enable anonymous access on the org that holds everything.
2. Move or import the wall dashboards into that org, along with read-only data source connections. Export as JSON from the main org and import into Wall; point the data sources at read-only credentials.
3. Enable anonymous access in grafana.ini (or the matching GF_AUTH_ANONYMOUS_* environment variables in Docker) and restart Grafana:

[auth.anonymous]
enabled = true
org_name = Wall
org_role = Viewer
hide_version = true
# optional: cap how many anonymous devices may connect
device_limit = 20

4. Build the URL with the org id of Wall: https://grafana.example.com/d/abc123/noc?orgId=2&kiosk&refresh=30s. Open it in a private browser window to confirm no login is asked.
5. Restrict who can reach Grafana if it is on the internet: an allow-list on your reverse proxy or firewall for the office and the screens, or keep Grafana on the private network and let the screens sit on that network.

Method 3: JWT URL login (self-hosted, private dashboards with full features)

Grafana can authenticate a request from a signed JSON Web Token, and with url_login the token may be passed as the auth_token query parameter. That is designed for exactly this case: a kiosk that cannot set headers. The screen becomes a real, named Viewer user, so variables, annotations, playlists and permissions all work, and nobody else can open the dashboard without the token.

1. Create a signing key pair on your workstation. Grafana verifies tokens with the public key; the private key never leaves your machine.

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out jwt-private.pem
openssl rsa -in jwt-private.pem -pubout -out jwt-public.pem

2. Install the public key on the Grafana host, for example /etc/grafana/jwt-public.pem, readable by the Grafana user.
3. Enable JWT auth in grafana.ini and restart Grafana. Users are created on first sight with the sub claim as their login, and expect_claims rejects tokens minted for anything else.

[auth.jwt]
enabled = true
header_name = X-JWT-Assertion
url_login = true
username_claim = sub
email_claim = email
key_file = /etc/grafana/jwt-public.pem
auto_sign_up = true
expect_claims = {"iss": "wall-displays"}
# role for auto-created users; Viewer is the default in most installs
# auto_assign_org_role = Viewer   (in the [users] section)

4. Mint a token for a dedicated user, with the expiry you want the screen to keep working. One year is common for a wallboard; shorter if the dashboard is sensitive. This uses PyJWT (pip install pyjwt cryptography):

import jwt, time
claims = {
  "sub": "wall-noc-1",
  "email": "wall-noc-1@example.com",
  "iss": "wall-displays",
  "iat": int(time.time()),
  "exp": int(time.time()) + 365 * 24 * 3600,
}
print(jwt.encode(claims, open("jwt-private.pem").read(), algorithm="RS256"))

5. Give the new user access. Open the URL once with the token so Grafana creates the user, then in Administration → Users confirm it is a Viewer in the right org and add it to a team that can see the wall dashboards. Set hide_version style hardening as you would for any viewer.
6. Build the URL: https://grafana.example.com/d/abc123/noc?orgId=1&kiosk&refresh=30s&auth_token=eyJhbGciOi…. Test it in a private window.

Method 4: auth proxy behind your own reverse proxy (self-hosted, private network)

With auth proxy, Grafana trusts a header such as X-WEBAUTH-USER set by a reverse proxy in front of it. If your screens have fixed addresses on the office network, the proxy can inject a viewer username for requests from those addresses only, and everyone else still logs in normally. Nothing is stored on the screen and no link can leak.

1. Enable the auth proxy in grafana.ini; whitelist must be the proxy's address so a spoofed header from anywhere else is ignored:

[auth.proxy]
enabled = true
header_name = X-WEBAUTH-USER
header_property = username
auto_sign_up = true
whitelist = 10.0.0.5
enable_login_token = false

2. Configure the proxy. In Caddy, for example, match the screens' addresses and set the header; every other client gets Grafana's normal login:

grafana.example.com {
  @screens remote_ip 10.0.20.0/24
  reverse_proxy @screens grafana:3000 {
    header_up X-WEBAUTH-USER wall-viewer
  }
  reverse_proxy grafana:3000
}

3. Make sure Grafana is reachable only through the proxy (bind it to localhost or a private interface). If Grafana's own port is exposed, anyone can send the header themselves.
4. Create the viewer by opening the dashboard once from a screen's address, then assign it read-only permissions on the wall folder.

Kiosk URL parameters worth knowing

Whichever method you chose, the URL you give the screen should describe exactly what to show. Grafana reads these query parameters: