teleport/docs/pages/application-access/getting-started.mdx

---
title: Getting Started with Teleport Application Access
description: Getting started with Teleport Application Access.
videoBanner: 5Uwhp3IQMHY
---

# Getting Started

Let's connect to Grafana using Teleport Application Access in three steps:

- Launch Grafana in a Docker container.
- Install the Teleport Application Service on a node and configure it to proxy Grafana.
- Access Grafana through Teleport.

<ScopedBlock scope={["oss", "enterprise"]}>
![Teleport Application Access Grafana Self-Hosted](../../img/application-access/grafana_selfhosted.png)
</ScopedBlock>
<ScopedBlock scope={["cloud"]}>
![Teleport Database Access CockroachDB Cloud](../../img/application-access/grafana_cloud.png)
</ScopedBlock>

## Prerequisites

(!docs/pages/includes/edition-prereqs-tabs.mdx!)

(!docs/pages/includes/tctl.mdx!)

- A Docker installation, which we will use to launch Grafana in a container. Alternatively, if you have another web application you'd like to protect with Application Access, you can use that instead.
- A host where you will run the Teleport Application Service.

<Admonition type="tip" title="Not yet a Teleport user?">
If you have not yet deployed the Auth Service and Proxy Service, you should follow one of our [getting started guides](../try-out-teleport/introduction.mdx) or try our Teleport Application Access [interactive learning track](https://play.instruqt.com/teleport/invite/rgvuva4gzkon). 
</Admonition>

We will assume your Teleport cluster is accessible at `teleport.example.com` and `*.teleport.example.com`. You can substitute the address of your Teleport Proxy Service. (For Teleport Cloud customers, this will be similar to `mytenant.teleport.sh`.)

<Admonition type="note" title="Application Access and DNS">
(!docs/pages/includes/dns-app-access.mdx!)
</Admonition>

## Step 1/3. Start Grafana

We've picked Grafana for this tutorial since it's very easy to run with zero
configuration required. If you have another web application you'd like to
expose, skip over to **Step 2**.

Grafana can be launched in a Docker container with a single command:

```code
$ docker run -d -p 3000:3000 grafana/grafana
```

## Step 2/3. Install and configure Teleport
(!docs/pages/includes/permission-warning.mdx!)

On your Application Service host, download the latest version of Teleport for
your platform from our
[downloads page](https://goteleport.com/download).

### Generate a token

A join token is required to authorize a Teleport Application Service instance to
join the cluster. Generate a short-lived join token and save it, for example,
in `/tmp/token` on your Teleport Application Service host:

```code
$ tctl tokens add \
    --type=app \
    --app-name=grafana \
    --app-uri=http://localhost:3000
```

### Start Teleport


Install Teleport on the host where you will run the Teleport Application Service. See our [Installation](../installation.mdx) page for options besides Linux servers.

(!docs/pages/includes/install-linux.mdx!)

Now start Teleport and point it to the application endpoint:

```code
$ sudo teleport app start \
  --name=grafana \
  --token=/tmp/token \
  --uri=http://localhost:3000 \
  --auth-server=https://teleport.example.com:3080
```

Change `https://teleport.example.com:3080` to the address and port of your Teleport Proxy Server. If you are a Teleport Cloud customer, use port 443 of your tenant's subdomain, e.g., `mytenant.teleport.sh:443`.

Make sure to update `--app-name` and `--app-uri` accordingly if you're using your own web application.

The `--token` flag points to the file on the Application Service host where we stored the token that we generated earlier.

### Create a user

Next, let's create a user to access the application we've just connected. Teleport has a built-in role called `access` that allows users to access cluster resources. Create a local user assigned this role:

```code
$ tctl users add --roles=access alice
```

The command will output a signup link. Use it to choose a password and set up a second factor. After that, it will take you to the Teleport Web UI.

## Step 3/3. Access the application

There are a couple of ways to access the proxied application.

Every application is assigned a public address that you can use to navigate to
the application directly. In our sample Grafana application we have provided a public address with
the `--app-public-addr` flag, so go to `https://grafana.teleport.example.com`
to access the app. 

Replace `grafana` with the value of the `--app-name` flag you used when starting the Teleport Application Service and `teleport.example.com` with the address of your Proxy Service.

If you're not logged into Teleport,
you will need to authenticate before the application will show.

Alternatively, log in to the Teleport Web Interface at `https://teleport.example.com` (replace with your Proxy Service's public address). All available applications are displayed on the Applications tab. Click on the Grafana application tile to access it.

## Next steps

Dive deeper into the topics relevant to your Application Access use-case:

- Learn in more detail about [connecting applications](./guides/connecting-apps.mdx) with Application Access.
- Learn about integrating with [JWT tokens](./jwt/introduction.mdx) for auth.
- Learn how to use Application Access with [RESTful APIs](./guides/api-access.mdx).
- See full configuration and CLI [reference](./reference.mdx).
- Read about how Let's Encrypt uses the [ACME protocol](https://letsencrypt.org/how-it-works/).