Skip to content
BoilStream

Choose credentials

concept
TL;DR

Sign in to your deployment, then obtain credentials for the interface and resource you need. Database credentials, ingest tokens, stream tokens and Schema Registry tokens are different. A catalog name does not grant access. Keep credentials private, preserve TLS verification and renew temporary credentials when they expire.

ComparisonIdentity, permission and endpoint are separate choices
Identity, permission and endpoint are separate choicesSigning in identifies a user. Catalog permissions authorize operations. An endpoint and its credential connect the chosen protocol to that authorization.What it answersUsed byIdentityWho is connecting?Sign-in or servicecredentialsCatalog accessWhich data and actions?Catalog permissionsScoped tokenWhich endpoint purpose?Ingest or stream endpointIdentity, permission and endpoint are separate choicesSigning in identifies a user. Catalog permissions authorize operations. An endpoint and its credential connect the chosen protocol to that authorization.What itanswersUsed byIdentityWho isconnecting?Sign-in orservicecredentialsCatalogaccessWhich dataand actions?CatalogpermissionsScoped tokenWhichendpointpurpose?Ingest orstreamendpoint
An ingest token is not a stream token. Successful authentication does not grant every catalog operation.

Use the web dashboard at your deployment’s /auth URL to sign in and obtain credentials for the interface you need. Use trusted TLS connections.

Web Auth Login

Choose a credential

Section titled “Choose a credential”
Interface Credential
PGWire Temporary host, port, user, password and database from the dashboard
Managed DuckDB Login or bootstrap session through the BoilStream extension; the extension handles short-lived catalog credentials
HTTP/2 Arrow and Kafka Topic-scoped ingest token
SSE Topic-scoped stream token from the CLI or API
Schema Registry Schema Registry token sent in the Authorization bearer header

HTTP ingest tokens are not interchangeable with login sessions or Flight bearer tokens. Pass each token exactly as its API specifies. In particular, HTTP Arrow uses /ingest/TOKEN, not /ingest/events with a generic JWT header.

Access to catalogs

Section titled “Access to catalogs”

BoilStream resolves the requesting user, tenant membership, product roles and direct grants before a catalog operation. Catalog access modes are reader, writer and admin. Catalog ownership is a separate concept, not a fourth client access mode.

The catalog UUID selects the resource. A display name or local DuckDB alias does not grant access. Sharing uses the owner’s catalog without copying its data. See Multi-tenancy and catalog sharing.

Sign-in and administration

Section titled “Sign-in and administration”

The available sign-in methods depend on deployment configuration. They can include local accounts with MFA, OAuth and SAML SSO. Use the Web Auth GUI guide for user workflows and the Entra ID guide for SAML setup.

Administrators configure identity providers, storage, roles and grants. Use the generated configuration reference and the dashboard rather than copying settings from an unrelated deployment. Preserve the deployment’s encryption and signing keys for restart and recovery.