Feature Request: Add support for custom query parameters and authentication in Geomap WMS panel

[frankli-n]

Use case / problem

I’m embedding a secured WMS-T service (Delft-FEWS) into Grafana Cloud’s Geomap panel.
Currently the panel only lets me specify:

• A base URL (it auto-appends ?SERVICE=WMS&REQUEST=…)
• A layer picker
• Display options (opacity, legend, attribution)

My WMS endpoint requires either:

1. A token=<static-token> query parameter on every request, or
2. HTTP Basic Auth / Bearer token in the Authorization: header

Since the panel strips any extra ?… parameters from the base URL and has no fields for headers, the only workaround is to stand up an external proxy (e.g. Cloudflare Worker) to re-inject the token and CORS headers. That is awkward, brittle, and forces users to host additional infrastructure.

Proposal

Enhance the Geomap WMS panel configuration to support:

1. Custom query parameters
   A simple key/value table (e.g. token → xyz) that Grafana will append to all WMS calls (GetCapabilities, GetMap, GetLegendGraphic, etc.).

2. Custom HTTP headers
   Fields for Authorization (and any other headers) so secure services can be accessed directly from the browser without CORS-workarounds.

[felix-mu]

Hi, thank you for reaching out. Currently there is no support for this since the Grafana Plugin Policy prohibits storing this kind of data as panel configuration.

The only way I currently see is providing a form for user input each time the panel is loaded like in this example: https://openlayers.org/en/latest/examples/sentinel-hub.html

Another possibility might be storing the credentials as dashboard variables and use them in the Panel editor to set the custom headers as you suggested.

Have you thought of any alternatives on how to store the sensitive data?

[frankli-n]

Thanks for your quick reply. I understand the blockers now. No I haven't thought of any alternatives for storing the data.

I'm trying to build a rain radar with a time slider so in addition to the sensitive data, needed to be able to add in time params. Does Grafana prohibit all params in the URL or just credentials?

[felix-mu]

Grafana does not prohibit any params in the URL. These are dashboard variables. As long as you save your credentials as dashboard variables (which I do NOT recommend, because they might be stored in plain text in the dashboard JSON) they might appear in the URL and are exposed.
What Grafana does not allow by their guidelines is to implement a plugin that stores credentials as panel options (plain text).

[felix-mu]

Have a look at the authentication url used in the masterportal: https://www.masterportal.org/mkdocs/doc/v3.0.0/services.json.html#markdown-header-wmslayer