PostgreSQL credentials from Web Auth

Sign in to the web dashboard, select the catalog and obtain temporary PGWire credentials. Use the returned host, port, database and username. The password belongs to that temporary credential; do not substitute your web login password.

Connect

psql "host=HOST port=PORT user=USER dbname=CATALOG sslmode=verify-full sslrootcert=/path/to/ca.pem"

Replace the placeholders with the deployment's values and enter the temporary password when prompted. For a public CA, use the trust configuration supported by your client. Avoid saving credential-bearing URLs in shell history.

For DBeaver or another SQL client, use its PostgreSQL driver and the same connection and TLS fields. PostgreSQL protocol support does not imply full PostgreSQL dialect or driver compatibility; verify the client workflow you need.

Catalog selection

Choose a catalog visible to your account. A streaming catalog has a name ending in __stream; a warehouse catalog uses ordinary DuckLake SQL. PGWire streaming INSERT is implemented, while COPY FROM STDIN ingestion is unavailable.

For native DuckDB, use managed catalog attachment through the BoilStream extension instead of reusing PGWire credentials for another interface.

Expiry and failures

Vend new credentials when the current ones expire or access changes. After a server failure, reconnect using a healthy endpoint supplied by your deployment. A lost connection may leave the outcome of a write unknown; reconcile before retrying it.

See Web Auth GUI, PGWire API and Interface compatibility for the complete workflow and limits.