Authenticating to Cockpit's Grafana using IAM

Reviewed on November 24, 2025

Starting November 3rd, 2025, Cockpit will be integrated with Scaleway IAM, allowing you to authenticate to your Cockpit's Grafana using your Scaleway credentials instead of Grafana credentials. This page explains how to prepare for the transition.

Reasons for the change

We are simplifying authentication and improving security by:

Removing the need to manage Grafana-specific users and passwords.
Enabling login using your existing Scaleway credentials.
Allowing central IAM-based access management.
Supporting Multi-Factor Authentication (MFA).

Transition timeline

Event	Date
IAM authentication becomes available	November 3rd, 2025
Legacy Grafana user login deprecation	January 20th, 2026

Grafana users not linked to Scaleway IAM will be deprecated. Refer to the table below to find out until when you can perform which actions.

Action	Available until
Logging in using Grafana user credentials	January 20th, 2026
Generate passwords for existing Grafana users	January 20th, 2026
Create new Grafana users	Disabled after November 3rd, 2025

What is changing?

From November 3rd, you will be able to choose from two authentication methods to log in to Grafana via the Scaleway console:

IAM authentication
Legacy authentication (using Grafana credentials)

Tip

Tick the Remember my choice checkbox after you have selected your authentication method to avoid being prompted to choose one again.
If you have selected an authentication method but would like to switch to the other, you need to clear your cookies. The pop-up prompting you to choose an authentication method should display again.

From November 3rd, you will be able to log in using your Scaleway credentials. When accessing Cockpit Grafana via the Scaleway console or a saved link, you will be redirected to Scaleway's account page to authenticate. If already authenticated, you will be automatically logged in Grafana without taking any further action.

New dashboard URLs

To support both login methods during the transition, Grafana dashboards will have a new URL:

Old URL (authentication via old Grafana users): https://<project_id>.dashboard.obs.fr-par.scw.cloud
New URL (IAM-authenticated): https://<project_id>.dashboard.cockpit.scaleway.com

Both links will be functional until January 20th, 2026, after which only the new IAM-based URLs will remain valid.

Who can access your Cockpit's Grafana?

Users must:

Be Owners or Members of your Scaleway Organization
Have access to the Scaleway Project where the Cockpit is located
Have been granted either the ObservabilityReadOnly, the AllProductsFullAccess, or the ObservabilityFullAccess IAM permission set

You can manage Members and permission sets in the IAM section of the Scaleway console.

Tip

Make sure that you review and manage permissions sets granted to current Members of your Organization, to either revoke or grant access accordingly.

How to access your Cockpit's Grafana

From the Scaleway console

Access to Grafana using the Scaleway console remains the same as before.

Click Cockpit in the Monitoring section of the console side menu. The Cockpit overview page displays.
Click Access Grafana to open your preconfigured or custom dashboards in Grafana. You will be automatically logged in using your Scaleway account.

From a saved/shared link

You can also access your Cockpit's Grafana using bookmarked links if you cannot access the Scaleway console.

Open the new IAM-compatible URL. If you are not already authenticated, the Scaleway login page displays.
Log in using your Scaleway credentials. Your Grafana dashboard displays.

Note

If you were already authenticated to Scaleway, you may be logged in automatically. In some multi-organization cases, depending on your most recent active Organization, you might still be prompted to log in again.

How to prepare for this transition

Make sure that you review and manage permissions sets granted to current Members of your Organization, to either revoke or grant access accordingly.
If you have Grafana users who are not in your Scaleway Organization:

Invite them as Members to your Organization.
Assign the ObservabilityReadOnly or the ObservabilityFullAccess permission sets only to the Projects they need to access.

Still need help?

Create a support ticket