# Query Tokens

> Create and manage tokens for reading telemetry data from Last9 using external visualization tools like Grafana.

Source: https://last9.io/docs/query-tokens/

![Control Plane — Query Tokens](../../../../../assets/content/docs/control-plane/query/query-tokens/control-plane-query-tokens.png)

[Query Tokens](https://app.last9.io/control-plane/query-tokens) provide read-only access to your telemetry data for external visualization tools like Grafana, alerting systems, and custom applications.

:::note[Access Requirements]
Only **Admins** can create and delete query tokens. Editors and Viewers can view existing tokens but cannot modify them. See [Users](/docs/users/#api-token-permissions) for the complete permission matrix.
:::

## Creating Query Tokens

![Control Plane — New Query Tokens](../../../../../assets/content/docs/control-plane/query/query-tokens/control-plane-query-tokens-create.png)

1. **Token Type** — choose based on what you're connecting:

   - **Prometheus** — read-only access to metrics for external tools like Grafana and alerting systems
   - **Client** — scoped access token for programmatic integrations; select a **Client Type** when you choose this option:
     - **MCP** — for connecting AI agents and workflow tools (n8n, OpenAI Responses API, custom agents) to Last9's MCP server

2. **Token Name**:

   - Use a descriptive name that identifies the token's purpose
   - Examples: "Grafana Dashboard", "n8n alert triage", "openai-sre-bot"

3. Click **CREATE TOKEN** to generate your token

:::note
**Client → MCP** tokens are Bearer tokens validated by the MCP server. Use them anywhere the MCP endpoint requires a `Authorization: Bearer <token>` header. They are not interchangeable with Prometheus tokens or the Refresh Token used by the self-hosted MCP binary.
:::

---

## Troubleshooting

Please get in touch with us on [Discord](https://discord.com/invite/Q3p2EEucx9) or [Email](mailto:support@last9.io) if you have any questions.