Authentication and authorization
Use the web dashboard at your deployment's /auth URL to sign in and obtain credentials for the interface you need. Use trusted TLS connections.
Choose a credential
| Interface | Credential |
|---|---|
| PGWire | Temporary host, port, user, password and database from the dashboard |
| Managed DuckDB | Login or bootstrap session through the BoilStream extension; the extension handles short-lived catalog credentials |
| HTTP/2 Arrow and Kafka | Topic-scoped ingest token |
| SSE | Topic-scoped stream token from the CLI or API |
| Schema Registry | Schema Registry token sent in the Authorization bearer header |
HTTP ingest tokens are not interchangeable with login sessions or Flight bearer tokens. Pass each token exactly as its API specifies. In particular, HTTP Arrow uses /ingest/TOKEN, not /ingest/events with a generic JWT header.
Access to catalogs
BoilStream resolves the requesting user, tenant membership, product roles and direct grants before a catalog operation. Catalog access modes are reader, writer and admin. Catalog ownership is a separate concept, not a fourth client access mode.
The catalog UUID selects the resource. A display name or local DuckDB alias does not grant access. Sharing uses the owner's catalog without copying its data. See Multi-tenancy and catalog sharing.
Sign-in and administration
The available sign-in methods depend on deployment configuration. They can include local accounts with MFA, OAuth and SAML SSO. Use the Web Auth GUI guide for user workflows and the Entra ID guide for SAML setup.
Administrators configure identity providers, storage, roles and grants. Use the generated configuration reference and the dashboard rather than copying settings from an unrelated deployment. Preserve the deployment's encryption and signing keys for restart and recovery.