1. Mint a key

In the BNG web UI, go to System → API Keys and create a new key using the
"Grafana / metrics only" preset. Selecting it sets the role to
read_only and restricts the key to /api/bng/prometheus/* — it cannot be
widened by mistake.

Click Create + reveal once and copy the token immediately. It is shown
exactly once; only its SHA-256 hash is stored, so if you lose it there is no
recovery — you must rotate or create a new key.

By default the preset gives the key a 365-day expiry (editable or clearable
before you create it); once it passes, the dashboards querying through it
stop returning data until you rotate the key or mint a new one.