# Use Tailscale identity in your Grafana HTTP service

Last validated Aug 7, 2026

> **Note:** Border0 + Tailscale is currently in beta.

Integrate Border0 identity headers in Grafana by using Grafana's built-in `auth.proxy` feature. When users connect to Grafana through a Border0 [HTTP socket][docs-border0-access-http-service], Border0 forwards [Tailscale identity information][docs-tailscale-identity] in headers such as:

* `X-Auth-Email`
* `X-Auth-Name`
* `X-Auth-Userid`
* `X-Auth-Username`

Grafana can trust these headers for automatic single-sign on (SSO) access.

## Enable Grafana configuration

In `grafana.ini`, enable the proxy identity provider and direct it to the `X-Auth-Email` header.

The following is a minimal `grafana.ini` configuration file:

```ini
[session]
cookie_secure = true

[users]
allow_sign_up = false
auto_assign_org = true
auto_assign_org_role = Admin

[auth]
disable_login_form = true
disable_signout_menu = true

[auth.anonymous]
enabled = false

[auth.basic]
enabled = false

[auth.proxy]
enabled = true
header_name = X-Auth-Email
header_property = username
auto_sign_up = true
headers = Email:X-Auth-Email
```

This configuration file directs Grafana to accept the Border0 HTTP header, automatically create users on first login, and assign the users to your organization.

## Test with Docker

Using the configuration above, you can start Grafana and test the configuration.

1. On a device that is running Docker, run the following command:

   ```shell
   docker run -i \
   -v $(pwd)/grafana.ini:/etc/grafana/grafana.ini \
   -p 3000:3000 grafana/grafana
   ```

2. Create a new [HTTP socket][docs-border0-access-http-service] in Border0 and point it to your Grafana instance. If the socket is running on the same machine as your connector, use `http://localhost:3000`. Otherwise, modify as needed for your environment.

When users connect through your HTTP socket, they will automatically sign in to Grafana with their Tailscale identity.

[docs-border0-access-http-service]: /docs/border0/how-to/access-http-service

[docs-tailscale-identity]: /docs/concepts/tailscale-identity