DigiUsher DocumentationConnecting a Grafana Cloud account
Connect your Grafana Cloud organization to DigiUsher with an organization slug and a Cloud Access Policy token scoped to org billing (read) to track usage-based spend across your Grafana Cloud stacks.
Overview
To connect your Grafana Cloud account to DigiUsher, create a Cloud Access Policy with read access to the org billing data. You create the policy in the Grafana Cloud management console. Then create a token under that policy, and give the token and your organization slug to DigiUsher. This page gives the access that DigiUsher asks for, the reason for that access, and the credentials that you give.
Organization-level management console, not the workspace
You create the credentials for this integration in the Grafana Cloud management console at grafana.com/orgs/<your-org>. This is the area for the account and the billing. You do not create them in a Grafana workspace, which Grafana calls a stack, for example <your-org>.grafana.net.
Summary of Access Required
| Component | Details |
|---|---|
| Identity | Grafana Cloud Access Policy token, read-only, for programmatic access only |
| Access level | Read-only. Billing and usage data at the level of the organization |
| Data | Billable usage per stack and per product per billing period |
| Scope | A single Grafana Cloud organization (identified by org slug) |
| Capability | What It Provides |
|---|---|
| Spend by product | Metrics, Logs, Traces, Profiles, and other Grafana Cloud services |
| Usage quantities | Active series, ingested logs/traces, and other billable units (product-dependent) |
| Spend by stack | Usage attributed to each stack within the organization |
DigiUsher cannot query your data sources, view dashboards, modify stacks, or change any Grafana Cloud configuration.
Prerequisites
Information to Gather
| Item | How to Find | DigiUsher Field |
|---|---|---|
| Organization slug | The identifier in the URL of your management console: grafana.com/orgs/<org-slug> | org_name |
| Access policy token | Created under an Access Policy with the scope org-billing-focus:read, as described in Setup. The token starts with glc_, and the page shows it one time only. | token |
Roles Required by the Person Performing Setup
| Role / Permission | Why |
|---|---|
| Org Admin on the Grafana Cloud organization | Only an org admin can create Cloud Access Policies and tokens. |
Network & Email Access (For Regulated Environments)
If your organization restricts outbound internet access or email domains, make sure that these two items are in place before you start:
- Domain allowlist. Add
*.digiusher.comto the allowlist of your network and your firewall. The users of your organization can then open the DigiUsher platform in their browsers. - Email allowlist. Add
digiusher.comas a permitted sender domain in your email security gateway. DigiUsher sends onboarding confirmations, alerts, and reports from@digiusher.comaddresses.
Setup
Open Access Policies
In the Grafana Cloud management console at grafana.com/orgs/<your-org>, open Security → Access Policies.
Note your organization slug. It is part of the page URL (grafana.com/orgs/<org-slug>), and it is one of the two values that you give to DigiUsher.
Create an Access Policy
Click New access policy and configure it for read access to the billing data.
- Enter a Display name and a Name, for example
digiusher-billing. - Under Realms, add your organization. The policy then applies to all stacks in the organization.
- Under Scopes, enable READ for the resource
org-billing-focus. This gives the scopeorg-billing-focus:read, which is the minimum. Do not enable Write, Delete, or another resource. - Click Create.
Create an API Token
On the access policy digiusher-billing, click Add token.
- Enter a Token name, for example
digiusher-billing-token. - Set Expiration to No expiry, or to a date before which you rotate the token. The section Credential Rotation describes the rotation.
- Make sure that the Scopes give
org-billing-focus:read. - Click Create token, then copy the token. It starts with
glc_.
Save your credential
CAUTION: Copy the token now and save it in a safe place. The page shows the token one time only, and you cannot read it again. You give this token to DigiUsher in the next section. If you lose the token, delete it and create a new token under the same access policy.
Make Sure You Have the Credentials
Before you continue, make sure that you have these two values:
- The organization slug from Step 1.
- The token from the access policy with the scope
org-billing-focus:read. The token starts withglc_.
Connect in DigiUsher
After completing the steps above, enter the following into DigiUsher to complete the connection:
| Field | Where to Find |
|---|---|
| Name | Any label you prefer, for example Grafana Cloud Production |
| Organization Name | The organization slug from Step 1 |
| API Token | The access policy token from Step 3 |
When you connect, DigiUsher validates the token against your organization and begins importing billing data. The first sync covers the current billing period and recent history. After that, DigiUsher ingests new usage data daily.
Setup Checklist
- Grafana Cloud organization with billing data
- Org Admin role on the organization
- Organization slug found and copied
- Access policy created with the scope
org-billing-focus:read, read only - Token created under the access policy and saved in a safe place
- Organization slug and token given to DigiUsher
-
*.digiusher.comin the allowlist of your network and firewall (if your organization restricts this) -
digiusher.comin the allowlist of permitted sender domains in your email security gateway (if your organization restricts this)
Security
What DigiUsher CAN Access (Read-Only)
- Billable usage data for each stack, product, and billing period
- Usage quantities for each product: active series, ingested logs and traces, and other billable units
What DigiUsher CANNOT Do
- Query a data source, open a dashboard, or read observability data
- Create, change, or delete a stack, a user, or a data source
- Create, rotate, or delete an access policy or a token
- Read or change the payment methods, the plan configuration, or the billing contacts
- Buy a product or change your account
Monitoring
Open Security → Access Policies to see the policies and tokens that exist and the last time each token was used. Delete every token that you do not know.
Credential Rotation
- In the Grafana Cloud console, add a new token to the access policy
digiusher-billing. - Give the new token to DigiUsher immediately.
- Delete the old token from the access policy.
Avoid ingestion gaps
Create the new token and give it to DigiUsher before you delete the old token. This prevents an interruption of the data collection.
Revocation
Delete the token at Security → Access Policies, or deactivate the access policy. Grafana Cloud then immediately invalidates the token and stops all access. DigiUsher cannot read billing data again until you give it a new token.
Troubleshooting
401 / 403 / invalid token
Make sure that the token belongs to an access policy with the scope org-billing-focus:read. Also make sure that the token is not expired and not deleted. Create the token again under the access policy and give it to DigiUsher again.
Organization slug not recognized
Make sure that you use the org slug from grafana.com/orgs/<org-slug>. A stack name (<name>.grafana.net) does not work, and a numeric org ID does not work.
No billing data or incomplete data
Grafana Cloud finalizes the billing data for each billing period. The usage in the middle of a period can therefore be absent. DigiUsher syncs daily and backfills as data is finalized.
Need Help?
If this page does not answer your question, write to DigiUsher support at support@digiusher.com. The team will help you.
Connecting a Redis Cloud account
Connect your Redis Cloud account to DigiUsher with an API account key and an API user key to track usage-based spend across your Redis Cloud subscriptions and databases.
Connecting a ClickHouse Cloud account
Connect your ClickHouse Cloud organization to DigiUsher with an organization ID and an API key (key ID + secret) to track usage-based spend across your ClickHouse Cloud services.