Connect Grafana

Your Agent answers Prometheus queries over HTTPS, so Grafana can chart its metrics directly. No second metrics store is needed.

Issue a reader token

You need to be an Admin.

Open Agent › Integrations and choose Add a reader.
On Prometheus reader, choose how long the token lasts, then Issue & enable.
Copy the token now. It’s shown once: the Agent keeps only its hash.

Rotate issues a new token and retires the old one. Disable reader stops access. The token can read metrics, and nothing else.

Add the data source in Grafana

Use your Agent’s own HTTPS address, not the icLens app’s:

apiVersion: 1
datasources:
  - name: icLens Agent
    uid: iclens-agent
    type: prometheus
    access: proxy
    url: ${METRA_PROMETHEUS_URL}
    jsonData:
      httpMethod: GET
      httpHeaderName1: Authorization
    secureJsonData:
      httpHeaderValue1: ${METRA_PROMETHEUS_AUTHORIZATION}

Set METRA_PROMETHEUS_AUTHORIZATION to Bearer <your token>, and keep TLS verification on.

Check it works

curl --fail-with-body --get "$METRA_PROMETHEUS_URL/api/v1/query" \
  --header "Authorization: $METRA_PROMETHEUS_AUTHORIZATION" \
  --data-urlencode 'query=iclens_canister_balance_cycles'

An empty result means nothing matched, not a zero balance.

What’s supported

Endpoint	Methods
`/api/v1/query`	GET, POST
`/api/v1/query_range`	GET, POST
`/api/v1/labels`	GET, POST
`/api/v1/label/<name>/values`	GET
`/api/v1/series`	GET, POST
`/api/v1/metadata`	GET
`/api/v1/status/buildinfo`	GET

Queries use the same PromQL as icLens. Scraping, remote write, federation and Alertmanager aren’t supported.

Good to know

The HTTP gateway between Grafana and your Agent sees the token. Only use trusted gateways, with TLS.
Answers aren’t certified, and aren’t cached.
To send metrics in from outside the Internet Computer, see OpenTelemetry metrics.