[OSS] How to configure grafana assistant via yaml provisioning

Grafana Configuration
,
1

  • What Grafana version and what operating system are you using?

    • Image Version: 13.0.1-security-01
    • K8s Version: v1.33.4+k3s1
    • OS: Ubuntu 24.04

  • What are you trying to achieve?

    • I want to provision the Grafana assistant plugin on startup without clickops.

  • How are you trying to achieve it?

    • Using the provisioning YAML.

  • What happened? The UI shows this error:

  • Something went wrong
An unexpected error occurred. Please try again.

  • What did you expect to happen?

    • Successful provisioning. It works when I put the required values directly in the UI.

  • Can you copy/paste the configuration(s) that you are having problems with?

  • apiVersion: 1
apps:
  - type: grafana-assistant-app
    # org_id: 1 # default
    # org_name: Main Org. # default
    disabled: false
    jsonData:
      backendUrl: https://assistant-prod-<region>.grafana.net/assistant
      isAccessTokenSet: true
      instanceId: ${GF_ASSISTANT_INSTANCE_ID}
      ossMode: true
    secureJsonData:
      accessToken: ${GF_ASSISTANT_ACCESS_TOKEN}

  • Did you receive any errors in the Grafana UI or in related logs? If so, please tell us exactly what they were.

  • logger=plugin.grafana-assistant-app t=2026-05-28T06:30:07.550420742Z level=error msg="Plugin Request Completed" statusSource=plugin endpoint=callResource pluginVersion=2.0.15 status=error duration=8.520213ms error="invalid access token" pluginId=grafana-assistant-app

  • Did you follow any online instructions? If so, what is the URL?

2

I figured it out. There were 2 issues with my config.

The token field should also include the instanceId, but didn’t.

When, Grafana converts the plugin config to json, the instanceId is converted to a number. Simply adding quotes to the Yaml won’t work

Here are the configs that worked for me (note that I am using kustomize)

  • Kubernetes secret that is added to grafana
apiVersion: v1
kind: Secret
metadata:
  name: grafana-secret
type: Opaque
stringData:
  
  GF_ASSISTANT_INSTANCE_ID: '''"<GF_ASSISTANT_INSTANCE_ID>"'''
  GF_ASSISTANT_ACCESS_TOKEN: "<GF_ASSISTANT_INSTANCE_ID>:<GF_ASSISTANT_ACCESS_TOKEN_RAW>"

The quoting method is required for use with kustomize. Inside the cluster it shows up like the below

GF_AUTH_GENERIC_OAUTH_CLIENT_ID: <GF_ASSISTANT_INSTANCE_ID_BASE_64_ENCODED>

GF_AUTH_GENERIC_OAUTH_CLIENT_ID: '"<GF_ASSISTANT_INSTANCE_ID_BASE_64_DECODED>"'
  • The plugin config
# filename: grafana-plugins-provision.yaml
apiVersion: 1
apps:
  - type: grafana-assistant-app
    # org_id: 1 # default
    # org_name: Main Org. # default
    disabled: false
    jsonData:
      backendUrl: https://assistant-prod-<region>.grafana.net/assistant
      isAccessTokenSet: true
      instanceId: "${GF_ASSISTANT_INSTANCE_ID}"
      ossMode: true
    secureJsonData:
      accessToken: "${GF_ASSISTANT_ACCESS_TOKEN}"

Which I created as it’s own secret with secretGenerator

secretGenerator:
- name: grafana-plugins-provision
  files:
    - grafana-plugins-provision.yaml
  options:
    disableNameSuffixHash: true

And referenced it in my helm chart values

extraSecretMounts:
  - name: plugins-provision
    mountPath: /etc/grafana/provisioning/plugins/plugins_provision.yaml
    secretName: grafana-plugins-provision
    subPath: grafana-plugins-provision.yaml
    readOnly: true
  • This is how the environment shows up in grafana
grafana-xxx:/usr/share/grafana$ env | grep ASSISTANT
GF_ASSISTANT_INSTANCE_ID='"<GF_ASSISTANT_INSTANCE_ID>"'
GF_ASSISTANT_ACCESS_TOKEN=<GF_ASSISTANT_INSTANCE_ID>:<GF_ASSISTANT_ACCESS_TOKEN_RAW>
  • This is how it is rendered in json
# /api/plugins/grafana-assistant-app/settings
...
"jsonData": {
    "backendUrl": "https://assistant-prod-<region>.grafana.net/assistant",
    "instanceId": "'\"<GF_ASSISTANT_INSTANCE_ID>\"'",
    "isAccessTokenSet": true,
    "ossMode": true
},
"secureJsonFields": {
    "accessToken": true
},
...

This is how it shows up in the UI

image
image1035×588 78.1 KB

3

Welcome @hayone1 great you figured it out the issue was Wrong accessToken format ->the accessToken in secureJsonData must be in the format instanceId:rawToken, not just the raw token alone so your secret value should be
GF_ASSISTANT_ACCESS_TOKEN : “your-instance-id:your-raw-access-token”

instanceId gets cast to a number by Grafana When Grafana parses the provisioning YAML it converts instanceId from a string to a number ,this breaks the plugin. The fix is to force it to stay a string by wrapping it in escaped quotes. the triple-quote trick is needed:
yaml
GF_ASSISTANT_INSTANCE_ID: ’ ’ ’ “your-instance-id” ’ ’ ’
Inside the cluster this renders as ’ “id” ’ ->the extra quotes survive YAML parsing and force Grafana to treat the value as a string, not a number.

Screenshot (299)
Screenshot (299)1347×764 48.6 KB

isAccessTokenSet : true in jsonData ->setting this in the provisioning YAML does not validate or confirm the token. It only hides the input field in the UI. If your token is wrong or empty, you still get invalid access token - the flag just makes it harder to notice.