Plugin management on Grafana Labs

Types of plugins

Fri, 03 Apr 2026 12:35:46 -0500

Types of plugins

Grafana supports three types of plugins:

Panels - These plugins make it easy to create and add any kind of panel, to show your data, or improve your favorite dashboards.
Data sources - These plugins allow you to pull data from various data sources such as databases, APIs, log files, and so on, and display it in the form of graphs, charts, and dashboards in Grafana.
Apps - These plugins enable the bundling of data sources, panels, dashboards, and Grafana pages into a cohesive experience.

Panel plugins

Add new visualizations to your dashboard with panel plugins, such as the Clock, Mosaic and Variable panels.

Use panel plugins when you want to:

Visualize data returned by data source queries.
Navigate between dashboards.
Control external systems, such as smart home devices.

Data source plugins

Data source plugins add support for new databases, such as Google BigQuery.

Data source plugins communicate with external sources of data and return the data in a format that Grafana understands. By adding a data source plugin, you can immediately use the data in any of your existing dashboards.

Use data source plugins when you want to query data from external or third-party systems.

Managing access for data source plugins

Administrators can grant access to data source plugins with LBAC.

Label Based Access Control (LBAC) customizes access rights based on team memberships, ensuring that users only query data relevant to their assigned permissions.

App plugins

Applications, or app plugins, bundle data sources and panels to provide a cohesive experience, such as the Zabbix app.

Apps can also add custom pages for things like control panels.

Use app plugins when you want an out-of-the-box monitoring experience.

Managing access for app plugins

Customize access to app plugins with RBAC.

By default, the Viewer, Editor and Admin roles have access to all app plugins that their Organization role allows them to access.

Access is granted by the fixed:plugins.app:reader role.

Note
To prevent users from seeing an app plugin, refer to these permissions scenarios.

Install a plugin

Fri, 03 Apr 2026 12:35:46 -0500

Install a plugin

Note
Installing plugins from the Grafana website into a Grafana Cloud instance will be removed during the first half of 2026.

If you’re a Grafana Cloud user, follow Install a plugin through the Grafana UI instead.

Install a plugin through the Grafana UI

The most common way to install a plugin is through the Grafana UI.

In Grafana, click Administration > Plugins and data > Plugins in the side navigation menu to view all plugins.
Browse and find a plugin.
Click the plugin’s logo.
Click Install.

You can use use the following alternative methods to install a plugin depending on your environment or setup.

Install a plugin using Grafana CLI

The Grafana CLI allows you to install, upgrade, and manage your Grafana plugins using a command line tool. For more information about Grafana CLI plugin commands, refer to Plugin commands.

Install a plugin from a ZIP file

This method is typically used for plugins not available in the Plugin Catalog or in environments without internet access.

Download the archive containing the plugin assets, and install it by extracting the archive into the plugin directory. For example:

unzip my-plugin-0.2.0.zip -d YOUR_PLUGIN_DIR/my-plugin

The path to the plugin directory is defined in the configuration file. For more information, refer to Configuration.

Install a plugin using Grafana configuration

Note
This feature requires Grafana 11.5.0 or later.

You can install plugins by adding the plugin ID to the plugins.preinstall section in the Grafana configuration file. This prevents the plugin from being accidentally uninstalled and can be auto-updated. For more information, refer to Configuration.

Install a plugin in air-gapped environment

Plugin installation usually requires an Internet connection. You can check which endpoints are used during the installation on your instance and add them to your instance’s allow list.

If this is not possible try installing a plugin using the Grafana CLI or as a ZIP file.

You can fetch any plugin from Grafana.com API following the download link referenced in the API. Here’s an example based on grafana-lokiexplore-app plugins.

Open https://grafana.com/api/plugins/grafana-lokiexplore-app and look for links section
Find a download url which looks something like https://grafana.com/api/plugins/grafana-lokiexplore-app/versions/1.0.2/download
Use this URL to download the plugin ZIP file, which you can then install as described above.

Install plugins using the Grafana Helm chart

With the Grafana Helm chart, you can install plugins using one of the methods described in this section. All the YAML snippets install v1.9.0 of the Grafana OnCall App plugin and the Redis data source plugin. When installation is complete you’ll get a confirmation message indicating that the plugins were successfully installed.

Method 1: Use the `plugins` field

Add the plugins you want to install as a list in your values file. For more information about the configuration, refer to the Helm chart configuration reference.

plugins:
  - https://grafana.com/api/plugins/grafana-oncall-app/versions/v1.9.0/download;grafana-oncall-app
  - redis-datasource

Method 2: Use `GF_PLUGINS_PREINSTALL_SYNC`

Add the following to your values.yaml file:

env:
  # Format: <plugin ID>@[<plugin version>]@<url to plugin zip>
  GF_PLUGINS_PREINSTALL_SYNC: grafana-oncall-app@1.9.0@https://grafana.com/api/plugins/grafana-oncall-app/versions/v1.9.0/download

  # Or without version and URL (latest version will be used)
  # GF_PLUGINS_PREINSTALL_SYNC: grafana-oncall-app

  # Multiple plugins (comma-separated)
  # GF_PLUGINS_PREINSTALL_SYNC: grafana-oncall-app,redis-datasource

Method 3: Use `GF_PLUGINS_INSTALL` (Deprecated since v12.1.0)

Add the following to your values.yaml file:

env:
  # Comma-separated list of plugin IDs
  GF_PLUGINS_INSTALL: grafana-oncall-app,redis-datasource

Plugin signatures

Fri, 03 Apr 2026 12:35:46 -0500

Plugin signatures

Plugin signature verification, also known as signing, is a security measure to make sure plugins haven’t been tampered with. Upon loading, Grafana checks to see if a plugin is signed or unsigned when inspecting and verifying its digital signature.

Learn more at plugin policies.

How does verification work?

At startup, Grafana verifies the signatures of every plugin in the plugin directory.

To see the result of this verification for each plugin, navigate to Configuration -> Plugins. A signature can have any of the following signature status:

Signature status	Description
Core	Core plugin built into Grafana.
Invalid signature	The plugin has an invalid signature.
Modified signature	The plugin has changed since it was signed. This may indicate malicious intent.
Unsigned	The plugin is not signed.
Signed	The plugin signature was successfully verified.

What happens if a plugin is not signed?

If a plugin is unsigned, then Grafana neither loads nor starts it. Grafana also writes an error message to the server log:

WARN[05-26|12:00:00] Some plugin scanning errors were found   errors="plugin '<plugin id>' is unsigned, plugin '<plugin id>' has an invalid signature"

Plugin signature levels

All plugins are signed under a signature level. The signature level determines how the plugin can be distributed.

Plugin Level	Description
Private	Private plugins are for use on your own Grafana. They may not be distributed to the Grafana community, and are not published in the Grafana catalog.
Community	Community plugins have dependent technologies that are open source and not for profit. Community plugins are published in the official Grafana catalog, and are available to the Grafana community.
Commercial	Commercial plugins have dependent technologies that are closed source or commercially backed. Commercial plugins are published on the official Grafana catalog, and are available to the Grafana community.

Plugin Level

Description

Private

Private plugins are for use on your own Grafana. They may not be distributed to the Grafana community, and are not published in the Grafana catalog.

Community

Community plugins have dependent technologies that are open source and not for profit.

Community plugins are published in the official Grafana catalog, and are available to the Grafana community.

Commercial

Commercial plugins have dependent technologies that are closed source or commercially backed.

Commercial plugins are published on the official Grafana catalog, and are available to the Grafana community.

Allow unsigned plugins

Note
Unsigned plugins are not supported in Grafana Cloud.

We strongly recommend that you don’t run unsigned plugins in your Grafana instance. However, if you’re aware of the risks and you still want to load an unsigned plugin, refer to Configuration.

If you’ve allowed loading of an unsigned plugin, then Grafana writes a warning message to the server log:

WARN[06-01|16:45:59] Running an unsigned plugin   pluginID=<plugin id>

Note
If you’re developing a plugin, then you can enable development mode to allow all unsigned plugins.

Sign a plugin you’ve developed

If you are a plugin developer and want to know how to sign your plugin, refer to Sign a plugin.

Customize navigation placement of plugin pages

Fri, 03 Apr 2026 12:35:46 -0500

By default, Grafana app plugins and their pages appear under the “More apps” section in the navigation menu. However, as a Grafana administrator, you might want to improve user experience by relocating specific pages or entire app plugins to more relevant sections of the navigation hierarchy. This guide shows you how to customize the placement of app plugin pages across different parts of your Grafana navigation menu.

You can change the location of your app plugin pages in two ways:

Move the entire app plugin (with all its pages) to a different section
Move specific pages from your app plugin to different sections

1. Move an entire app plugin to a different section

To relocate an entire app plugin to a different navigation section, use the navigation.app_sections configuration in your Grafana configuration file:

[navigation.app_sections]
org-example-app = explore 100

This configuration:

Moves the app plugin with ID org-example-app
Places it in the explore section
Assigns it a sort weight of 100 (determining its position within that section)

2. Move individual app pages to different sections

To move specific pages from an app plugin to different navigation sections, use the navigation.app_standalone_pages configuration:

[navigation.app_standalone_pages]
/a/org-example-app/dashboard-page = dashboards 200
/a/org-example-app/monitoring-page = alerting 50

This configuration:

Moves the page with path /a/org-example-app/dashboard-page to the dashboards section with sort weight 200
Moves the page with path /a/org-example-app/monitoring-page to the alerting section with sort weight 50

Complete example

Here’s a complete example that configures both the app placement and individual page placement in your Grafana configuration:

# Move the entire app to the Explore section
[navigation.app_sections]
org-example-app = explore 50

# Move specific pages to their own sections
[navigation.app_standalone_pages]
/a/org-example-app/metrics = dashboards 100
/a/org-example-app/logs = alerting 75

Find page paths

To move individual pages you need to know their paths. To identify a plugin page path:

Visit the page in the browser and check the URL in the address bar.
Page paths in app plugins follow the format /a/PLUGIN_ID/PAGE_PATH

Troubleshooting

If your navigation changes don’t appear:

Verify your configuration syntax is correct
Ensure you’ve restarted Grafana after making changes
Check that the plugin IDs and page paths exactly match what’s defined in your plugin

Plugin backend communication

Fri, 03 Apr 2026 12:35:46 -0500

Allow plugin backend communication

By default, you can only communicate with plugin backends remotely.

However, you can configure your Grafana instance to let the frontends of installed plugins to directly communicate with the backends of other plugins installed locally. You can use this configuration to, for example, enable a canvas panel to call an application resource API that is permitted by the actions_allow_post_url option.

Integrate your plugins

To enable backend communication between plugins, set the plugins you want to communicate with. In your configuration file (grafana.ini or custom.ini depending on your operating system), remove the semicolon to enable and then set the following configuration option:

  actions_allow_post_url=

This is a comma-separated list that uses glob matching.

To allow access to all plugins that have a backend, use:

actions_allow_post_url=/api/plugins/*

To access the backend of only one plugin, use:

actions_allow_post_url=/api/plugins/<GRAFANA_SPECIAL_APP>

Isolate plugin code with the Plugin Frontend Sandbox

Fri, 03 Apr 2026 12:35:46 -0500

Isolate plugin code with the Plugin Frontend Sandbox

Caution
Plugin Frontend Sandbox is currently in public preview. Grafana Labs offers limited support, and breaking changes might occur prior to the feature being made generally available.

The Plugin Frontend Sandbox is a security feature that isolates plugin frontend code from the main Grafana application. When enabled, plugins run in a separate JavaScript context, which provides several security benefits:

Prevents plugins from modifying parts of the Grafana interface outside their designated areas
Stops plugins from interfering with other plugins functionality
Protects core Grafana features from being altered by plugins
Prevents plugins from modifying global browser objects and behaviors

Plugins running inside the Frontend Sandbox should continue to work normally without any noticeable changes in their intended functionality.

When to use the Plugin Frontend Sandbox

We strongly recommend enabling the Frontend Sandbox for plugins that allow users to write custom JavaScript code for data visualization or manipulation, since they can potentially execute arbitrary JavaScript code in your Grafana instance. The sandbox provides an additional layer of security by restricting what this code can access and modify.

These are examples of plugins where the sandbox is particularly useful:

Panel plugins that allow users to write custom JavaScript code
Plugins from untrusted sources

Compatibility and requirements

The following applies:

The Frontend Sandbox is available in public preview in Grafana >=11.5. It’s compatible with all types of plugins including app plugins, panel plugins, and data source plugins.
Angular-based plugins are not supported.
Plugins developed and signed by Grafana Labs are excluded and cannot be sandboxed.

Enable the Frontend Sandbox

For self-hosted Grafana installations, add the plugin IDs you want to sandbox in the security section using the enable_frontend_sandbox_for_plugins configuration option.

For Grafana Cloud users, you can simply use the toggle switch in the plugin catalog page to enable or disable the sandbox for each plugin. By default, the sandbox is disabled for all plugins.

Note
Enabling the Frontend Sandbox might impact the performance of certain plugins. Only disable the sandbox if you fully trust the plugin and understand the security implications.

Troubleshooting

If a plugin isn’t functioning correctly with the Frontend Sandbox enabled:

Temporarily disable the sandbox for that specific plugin
Test if the plugin works correctly without the sandbox
If the plugin only works with the sandbox disabled, ensure you trust the plugin source before continuing to use it without sandbox protection
Report any sandbox-related issues to the plugin developer

Plugin management on Grafana Labs

Types of plugins

Types of plugins

Panel plugins

Data source plugins

Managing access for data source plugins

App plugins

Managing access for app plugins

Install a plugin

Install a plugin

Install a plugin through the Grafana UI

Install a plugin using Grafana CLI

Install a plugin from a ZIP file

Install a plugin using Grafana configuration

Install a plugin in air-gapped environment

Install plugins using the Grafana Helm chart

Method 1: Use the plugins field

Method 2: Use GF_PLUGINS_PREINSTALL_SYNC

Method 3: Use GF_PLUGINS_INSTALL (Deprecated since v12.1.0)

Plugin signatures

Plugin signatures

How does verification work?

What happens if a plugin is not signed?

Plugin signature levels

Allow unsigned plugins

Sign a plugin you’ve developed

Customize navigation placement of plugin pages

Customize navigation placement of app plugin pages

Customize app and page navigation placement

1. Move an entire app plugin to a different section

2. Move individual app pages to different sections

Complete example

Find page paths

Troubleshooting

Plugin backend communication

Allow plugin backend communication

Integrate your plugins

Isolate plugin code with the Plugin Frontend Sandbox

Isolate plugin code with the Plugin Frontend Sandbox

When to use the Plugin Frontend Sandbox

Compatibility and requirements

Enable the Frontend Sandbox

Troubleshooting

Method 1: Use the `plugins` field

Method 2: Use `GF_PLUGINS_PREINSTALL_SYNC`

Method 3: Use `GF_PLUGINS_INSTALL` (Deprecated since v12.1.0)