How to show a private Grafana dashboard on a TV without a login screen

Method 1Share the dashboard with a link

Grafana calls this externally shared dashboards in current versions and public dashboards in older ones (public dashboards became generally available in Grafana 10.0). It produces a read-only URL that runs the dashboard's stored queries for anyone who has the link, with no login. It is the safest option because the screen holds no credential at all, and it is the only option on Grafana Cloud. You need to be an organisation admin, or hold the dashboards.public:write permission, to create one.

1. Make a copy for the wall

   Open the dashboard, choose Save as copy, and name it, for example, NOC wall. Shared links do not support template variables, so in the copy replace each variable with the fixed value the wall should show. Remove panels that use frontend data sources or library panels; they render empty on a shared link.

2. Share it

   Click the Share dropdown at the top of the dashboard and choose Share externally. On Grafana 10 the same option is the Public dashboard tab of the Share dialog.

3. Choose who can open it

   Select Anyone with the link, tick the acknowledgement checkbox and click Accept. The Only specific people option emails one-time links that expire; it is meant for humans, not screens.

4. Set the options

   Leave Enable time range off so the wall cannot be changed by whoever finds the link, and turn Display annotations on only if the wall should show them.

5. Copy the link

   https://grafana.example.com/public-dashboards/8f2c…

   The shared view already has no menus, so it needs no kiosk parameter. Auto-refresh is not part of the shared view, so refresh from the screen instead: in DisplayOps set the display's Auto refresh to one to five minutes (see below).

6. Later: pause or revoke

   Pause access stops the link temporarily and keeps the URL; Revoke access kills it for good and you must share again.

Method 2An anonymous viewer organisation (self-hosted)

Anonymous access lets unauthenticated visitors view one organisation with a role you choose. It supports everything a normal viewer sees, including template variables, playlists and links between dashboards. It is a server setting in grafana.ini, available on self-managed OSS and Enterprise only, not on Grafana Cloud. On Grafana Enterprise anonymous devices count towards licensed users, one user per three devices.

1. Create a dedicated org

   AdministrationGeneralOrganizations+ New org, for example Wall. Note its ID in the list; you need it for the URL. Anonymous visitors will see this org only, so never enable anonymous access on the org that holds everything.

2. Move or import the wall dashboards

   Into that org, along with read-only data source connections. Export as JSON from the main org and import into Wall; point the data sources at read-only credentials.

3. Enable anonymous access

   In grafana.ini (or the matching GF_AUTH_ANONYMOUS_* environment variables in Docker), then restart Grafana:

   [auth.anonymous]
   enabled = true
   org_name = Wall
   org_role = Viewer
   hide_version = true
   # optional: cap how many anonymous devices may connect
   device_limit = 20

4. Build the URL

   With the org id of Wall:

   https://grafana.example.com/d/abc123/noc?orgId=2&kiosk&refresh=30s

   Open it in a private browser window: no login is asked.

5. Restrict who can reach Grafana

   If it is on the internet: an allow-list on your reverse proxy or firewall for the office and the screens, or keep Grafana on the private network and let the screens sit on that network.

Method 3Auth proxy behind your own reverse proxy (self-hosted)

With auth proxy, Grafana trusts a header such as X-WEBAUTH-USER set by a reverse proxy in front of it. If your screens have fixed addresses on the office network, the proxy can inject a viewer username for requests from those addresses only, and everyone else still logs in normally. Nothing is stored on the screen and no link can leak.

1. Enable the auth proxy

   In grafana.ini; whitelist must be the proxy's address so a spoofed header from anywhere else is ignored:

   [auth.proxy]
   enabled = true
   header_name = X-WEBAUTH-USER
   header_property = username
   auto_sign_up = true
   whitelist = 10.0.0.5
   enable_login_token = false

2. Configure the proxy

   In Caddy, for example, match the screens' addresses and set the header. Every other client must have the header removed, otherwise anyone could add it themselves and become the wall viewer:

   grafana.example.com {
     @screens remote_ip 10.0.20.11 10.0.20.12
     reverse_proxy @screens grafana:3000 {
       header_up X-WEBAUTH-USER wall-viewer
     }
     reverse_proxy grafana:3000 {
       header_up -X-WEBAUTH-USER
     }
   }

3. Make sure Grafana is reachable only through the proxy

   Bind it to localhost or a private interface. If Grafana's own port is exposed, anyone can send the header themselves.

4. Screens outside the office: swap the allow-list for basic auth

   Protect the screens' route with the proxy's basic auth (basic_auth in Caddy, auth_basic in nginx) and set X-WEBAUTH-USER for requests that pass it. Store that username and password on the DisplayOps content item and the screen answers the prompt itself, from anywhere over HTTPS. The HTTP authentication guide has the proxy snippets.

5. Create the viewer

   Open the dashboard once from a screen's address, then assign the auto-created user read-only permissions on the wall folder.

Why JWT URL login (auth_token) is not the answer

Grafana can authenticate a request with a signed JSON Web Token, and with url_login = true it also accepts the token as the auth_token query parameter. Many guides present this as the kiosk solution. It is not, and we checked the current source before saying so: the JWT client authenticates the single request that carries the token and removes the parameter from the URL; nothing creates a session. The dashboard page renders, but every data request the page then makes arrives without a token and is rejected, so the panels stay empty or the page bounces to the login screen. Older releases created a session cookie here; Grafana 10.2.8 and newer do not (tracked as grafana/grafana#90200).

JWT auth still has two legitimate uses for screens: a reverse proxy that adds the token as a header on every request, which is the auth proxy method above with a signed token instead of a plain username, and header injection by the player itself, which is on the DisplayOps roadmap. If you already configured [auth.jwt], keep the key material; it will plug straight into either.

What the configuration looks like, for the proxy or header-injection case

1. Create a signing key pair

   On your workstation. Grafana verifies tokens with the public key; the private key never leaves your machine.

   openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out jwt-private.pem
   openssl rsa -in jwt-private.pem -pubout -out jwt-public.pem

2. Install the public key

   On the Grafana host, for example /etc/grafana/jwt-public.pem, readable by the Grafana user.

3. Enable JWT auth

   In grafana.ini and restart Grafana. Users are created on first sight with the sub claim as their login, and expect_claims rejects tokens minted for anything else.

   [auth.jwt]
   enabled = true
   header_name = X-JWT-Assertion
   url_login = true
   username_claim = sub
   email_claim = email
   key_file = /etc/grafana/jwt-public.pem
   auto_sign_up = true
   expect_claims = {"iss": "wall-displays"}
   # role for auto-created users; Viewer is the default in most installs
   # auto_assign_org_role = Viewer   (in the [users] section)

4. Mint a token

   For a dedicated user, with the expiry you want the screen to keep working. One year is common for a wallboard; shorter if the dashboard is sensitive. This uses PyJWT (pip install pyjwt cryptography):

   import jwt, time
   claims = {
     "sub": "wall-noc-1",
     "email": "wall-noc-1@example.com",
     "iss": "wall-displays",
     "iat": int(time.time()),
     "exp": int(time.time()) + 365 * 24 * 3600,
   }
   print(jwt.encode(claims, open("jwt-private.pem").read(), algorithm="RS256"))

5. Send it as a header, not in the URL

   Configure your reverse proxy to add X-JWT-Assertion: <token> for the screens' addresses (the same shape as the Caddy example in the auth proxy method, with this header instead of X-WEBAUTH-USER) and to strip that header from everyone else. Grafana then authenticates every request the dashboard makes.

6. Check the user

   After the first load, AdministrationUsers and accessUsers shows the auto-created user; confirm it is a Viewer in the right org and can see the wall folder.

HTTPS only, and no refresh tokens

Grafana's documentation warns that a token in a URL can end up in logs and be hijacked without TLS. Grafana does not support refresh tokens, so when a token expires the screen shows the login page; put the expiry date in your calendar or in the display's name.

Kiosk URL parameters worth knowing

Whichever method you chose, the URL you give the screen should describe exactly what to show. Grafana reads these query parameters. Grafana 13 turned dynamic dashboards on for everyone; the parameters below are unchanged there.