Skip to content
BoilStream

Sign in and get access

tutorial
TL;DR

Open your deployment’s authentication dashboard to sign in and select an authorized catalog or topic. The dashboard provides temporary database credentials and selected token types. Use the returned endpoints and trusted TLS settings. SSE stream tokens currently come from the CLI or API, rather than the dashboard.

Message sequenceSign in, select a catalog, then connect
Sign in, select a catalog, then connectThe user signs in to the dashboard, selects an authorized catalog and obtains the connection details for a SQL client. The server checks the resulting client credentials and catalog permissions.YouDashboardBoilStreamSign inAuthorized catalogsChoose catalog and interfaceConnection detailsConnect with client credentialsAuthorized session or errorTime moves downward · dashed arrows are responsesSign in, select a catalog, then connectThe user signs in to the dashboard, selects an authorized catalog and obtains the connection details for a SQL client. The server checks the resulting client credentials and catalog permissions.YouDashboardBoilStreamSign inAuthorized catalogsChoose catalog andinterfaceConnection detailsConnect with clientcredentialsAuthorized session orerrorTime moves downward · dashed arrows are responses
Dashboard sign-in and a database connection are distinct steps. Use the credentials intended for the selected interface.

Open https://your-server.example/auth and sign in using a method enabled by your administrator. The dashboard supplies credentials for your authorized catalogs and topics. Use the endpoint values it returns rather than assuming a port or node hostname.

Database credentials

Section titled “Database credentials”

For PGWire, select the catalog and obtain its temporary connection details. Configure your client with the supplied host, port, database, user, password and trusted TLS certificate. Renew credentials when they expire; a web login password is not a permanent database password.

See PostgreSQL wire protocol for SQL and client limits. A failed connection does not imply that an in-flight write was rolled back.

Native DuckDB

Section titled “Native DuckDB”

Follow the native DuckDB connection guide to authenticate, discover a catalog UUID and attach it.

Tokens

Section titled “Tokens”

Select the token purpose in the dashboard:

  • Ingest authorizes production to the selected topic through HTTP Arrow or Kafka.
  • Schema Registry authorizes schema discovery through its bearer-authenticated API; no topic selection is required.

Pass the returned token unchanged. For HTTP ingestion the endpoint is https://HOST:PORT/ingest/TOKEN; the body is binary Arrow IPC. Use the HTTP ingestion example, which checks the admitted row count and preserves input after errors. A generic bearer JWT against /ingest/events is not this API.

For SSE consumption, obtain a stream-purpose token through the CLI or API as described in the SSE guide. SSE remains a preview; token revalidation and automatic reconnection do not establish gap-free delivery.

Authorization (RBAC)

Section titled “Authorization (RBAC)”

Administrators assign product roles, tenant membership and catalog grants. Catalog permissions resolve to reader, writer or admin. Ownership identifies the tenant that holds the physical data. See Catalog sharing for the current grant workflow and limits.

Use the superadmin interface for storage configuration, identity providers and user administration. Keep storage credentials and deployment encryption keys separate from short-lived client tokens.

MFA and SSO

Section titled “MFA and SSO”

Use the dashboard to manage the MFA methods enabled for your account and to review active sessions. Store recovery codes outside the device used for sign-in.

For SAML setup, use the Entra ID guide. Provider and local login behavior depends on the deployment’s policy; a server upgrade or a different installation may expose different options.

Troubleshooting

Section titled “Troubleshooting”
Symptom Check
PGWire authentication fails Get fresh credentials; use its returned host, port and catalog
Catalog is not found in DuckDB List authorized catalogs and explicitly attach the correct UUID
Access is denied Check the requesting user’s membership, role and catalog grant
HTTP ingestion rejects a token Use the ingest purpose, the correct topic and the exact returned token
SSE rejects a token Use the stream purpose and check expiry or revocation
TLS connection fails Check the hostname, certificate chain and trusted CA; do not bypass verification

Use Configuration for deployment settings and Authentication and authorization for credential types.