Loki (multi-tennancy) datasource in Grafana 13.0.1 fails

Grafana Configuration
,
1

Hi there,

There is a problem in Grafana 13.0.1 when adding a new LOKI datasource with multi-tennancy. The configured header (Header:X-Scope-OrgID,Value:) is not transfered in the health query to LOKI. In consequence LOKI responds with a “forbidden” message.

Loki is configured on multi-tenancy, in grafana all parameters are correct. I tried to configure the datasource as well in the UI as provisioned, with the same result.

Connection and query from command line with curl are functionning.

Did someone made the same experience?

Best regards

Johanna

2

In this issue the problem is that when Loki is running in multitenancy mode (auth_enabled: true), the X-Scope-OrgID header must be included
in every request including the health check. Grafana’s health check was not sending
this header, causing Loki to reject it.
Without X-Scope-OrgID header - health check fails

Screenshot (301)
Screenshot (301)1920×733 92.3 KB

Screenshot (300)
Screenshot (300)1920×906 108 KB

The fix is to add the header via secureJsonData in your datasource provisioning yaml
yaml
apiVersion: 1
datasources:

  • name: Loki
    type: loki
    access: proxy
    url: “loki-gateway.grafana.svc.cluster.local”
    editable: true
    jsonData:
    httpHeaderName1: X-Scope-OrgID
    secureJsonData:
    httpHeaderValue1: your-tenant-id
    tenant ID would be whatever your Loki tenant is named → for example production, team, org1 etc. It can be any alphanumeric string that matches what your Loki instance expects.
    Screenshot (302)
    Screenshot (302)1920×917 116 KB

Using secureJsonData instead of jsonData for the header value ensures the token is encrypted and properly sent with all requests including health checks. This works in both UI configuration and provisioning yaml.The critical point is that httpHeaderValue1 must be under secureJsonData not jsonData. If you put it under jsonData it won’t be encrypted and may not be sent correctly with the health check request

3

Hi,

thanks for the hints. I have made already the correct configuration (Header and Value). I tried it both ways provisioned and via UI. But the Header-Configuration is not transferred in the request path to loki, as shown bellow.

I use the Grafana Loki core datasource. In your logs example I saw that you are using the grafana-lokiexplore-app, maybe that made the difference.

Best regards Johanna

May 28 08:10:22 xxx grafana[28999]: logger=tsdb.loki endpoint=checkHealth pluginId=loki dsName=LokiGustav dsUID=cfneoibg8kbnka uname=xxx fromAlert=false t=2026-05-28T08:10:22.024745107Z level=debug msg=“Error received from Loki” error=“Get “https://xxxx:3100/loki/api/v1/query?direction=backward&query=vector(1)%2Bvector(1)&time=4000000000\”: Forbidden” status=error duration=23.195215ms stage=databaseRequest start=1970-01-01T00:00:01Z end=1970-01-01T00:00:04Z step=1s query=vector(1)+vector(1) queryType=instant direction=backward maxLines=0 supportingQueryType=none lokiHost=xxx:3100 lokiPath=/loki/api/v1/query
May 28 08:10:22 xxx grafana[28999]: logger=tsdb.loki endpoint=checkHealth pluginId=loki dsName=LokiGustav dsUID=cfneoibg8kbnka uname=xxx fromAlert=false t=2026-05-28T08:10:22.024838715Z level=debug msg=“Executed queries” duration=23.35793ms queriesLength=1 runInParallel=false
May 28 08:10:22 xxx grafana[28999]: logger=tsdb.loki endpoint=checkHealth t=2026-05-28T08:10:22.02486415Z level=error msg=“Loki health check failed” error=“error from loki: Get “https://xxx:3100/loki/api/v1/query?direction=backward&query=vector(1)%2Bvector(1)&time=4000000000\”: Forbidden”
May 28 08:10:22 xxx grafana[28999]: logger=context userId=6 orgId=1 uname=xxx t=2026-05-28T08:10:22.024917105Z level=info msg=“Request Completed” method=GET path=/api/datasources/uid/cfneoibg8kbnka/health status=400 remote_addr=10.23.43.13 time_ms=33 duration=33.766009ms size=106 referer=https://xxx/connections/datasources/edit/cfneoibg8kbnka handler=/api/datasources/uid/:uid/health status_source=server

4

Thank you for the detailed logs.
I tested this on Grafana 13.0.1 with the core Loki datasource and multi-tenancy enabled (auth_enabled: true). The X-Scope-OrgID header is correctly sent including in the health check — datasource connects successfully.

Screenshot (353)
Screenshot (353)1920×913 138 KB

The key clue in your logs is that you’re getting Forbidden(403), not no org id (401).
401 “no org id” = header is missing
403 Forbidden = header is present but being rejected by something

This means the problem is not Grafana ->something between Grafana and Loki a reverse proxy, gateway, or nginx is blocking the X-Scope-OrgID header.
Test curl directly to Loki’s port bypassing any proxy->
curl -H X-Scope-OrgID: your-tenant “loki-ip:3100/loki/api/v1/query?query=vector(1)”
Make sure Grafana’s Loki URL points directly to Loki not through a proxy that may block custom headers.

Screenshot (354)
Screenshot (354)1920×917 144 KB

Make sure you are setting the tenant ID correctly via HTTP Headers
Header name: X-Scope-OrgID
Header value: your-tenant-id (tenant1)
Check your provisioning YAML → make sure httpHeaderValue1 is under secureJsonData not jsonData
yaml
jsonData:
httpHeaderName1: X-Scope-OrgID
secureJsonData:
httpHeaderValue1: your-tenant-id

5

Thank’s a lot for the helpfull comments

Best regards Johanna