From af3767cdb807068a2a730c2967789af45d86d952 Mon Sep 17 00:00:00 2001
From: Pratik Mankawde <3397372+pratikmankawde@users.noreply.github.com>
Date: Thu, 6 Aug 2026 14:27:38 +0100
Subject: [PATCH] docs(telemetry): document the render token alert screenshots
 now need

Grafana 13 enables the renderAuthJWT feature toggle by default, so the image
renderer silently drops render requests carrying the default token and alert
notifications arrive with no panel image. The runbook's alerting section
covered delivery but not this failure mode.

Adds how the token is wired (one variable feeding both services, so they cannot
drift), how to override it, and the two-command check for when images stop
appearing.
---
 docs/telemetry-runbook.md | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/docs/telemetry-runbook.md b/docs/telemetry-runbook.md
index 1ae7059aa7..49b2827a45 100644
--- a/docs/telemetry-runbook.md
+++ b/docs/telemetry-runbook.md
@@ -2286,6 +2286,33 @@ Three traps worth knowing before you edit this file:
 To add a third destination (PagerDuty, Opsgenie, a custom webhook), add a receiver
 to the relevant contact point.
 
+#### Panel screenshots on alerts need a matching render token
+
+Alert notifications that carry a panel image are rendered by the `renderer`
+sidecar, not by Grafana itself. Grafana 13 enables the `renderAuthJWT` feature
+toggle by default, so the renderer rejects any request whose token is missing or
+still the `-` default — notifications then arrive with no image.
+
+`docker-compose.yml` feeds both sides from one variable, so they cannot drift:
+`GF_RENDERING_RENDERER_TOKEN` on the `grafana` service and `AUTH_TOKEN` on the
+`renderer` service both read `${GF_RENDERING_RENDERER_TOKEN}`, defaulting to a
+local development value. Override it in the environment to use your own:
+
+```bash
+GF_RENDERING_RENDERER_TOKEN=$(openssl rand -hex 16) \
+    docker compose -f docker/telemetry/docker-compose.yml up -d grafana renderer
+```
+
+If images stop appearing, check that the two containers agree — a token set on
+only one side fails exactly this way:
+
+```bash
+docker compose -f docker/telemetry/docker-compose.yml exec grafana \
+    printenv GF_RENDERING_RENDERER_TOKEN
+docker compose -f docker/telemetry/docker-compose.yml exec renderer \
+    printenv AUTH_TOKEN
+```
+
 #### Deploying alerts to Grafana Cloud
 
 Grafana Cloud has **no provisioning filesystem**, so these `apiVersion: 1` files