Web Auth GUI

Open https://your-server.example/auth and sign in using a method enabled by your administrator. The dashboard supplies credentials for your authorized catalogs and topics. Use the endpoint values it returns rather than assuming a port or node hostname.

Database credentials

For PGWire, select the catalog and obtain its temporary connection details. Configure your client with the supplied host, port, database, user, password and trusted TLS certificate. Renew credentials when they expire; a web login password is not a permanent database password.

See PostgreSQL wire protocol for SQL and client limits. A failed connection does not imply that an in-flight write was rolled back.

Native DuckDB

Use the BoilStream extension for login or bootstrap-token authentication:

INSTALL boilstream FROM community;
LOAD boilstream;
PRAGMA boilstream_bootstrap_session('https://your-server.example/secrets:<token>');
FROM boilstream_ducklakes();
PRAGMA boilstream_attach_ducklake('<catalog-uuid>', 'my_catalog');

Replace the UUID with the catalog ID returned by discovery. The extension handles the short-lived catalog credentials. Catalog storage credentials stay on the server. See DuckLake integration.

Tokens

Select the token purpose in the dashboard:

• Ingest authorizes production to the selected topic through HTTP Arrow or Kafka.
• Schema Registry authorizes schema discovery through its bearer-authenticated API; no topic selection is required.

Pass the returned token unchanged. For HTTP ingestion the endpoint is https://HOST:PORT/ingest/TOKEN; the body is binary Arrow IPC. Use the HTTP ingestion example, which checks the admitted row count and preserves input after errors. A generic bearer JWT against /ingest/events is not this API.

For SSE consumption, obtain a stream-purpose token through the CLI or API as described in the SSE guide. SSE remains a preview; token revalidation and automatic reconnection do not establish gap-free delivery.

Authorization (RBAC)

Administrators assign product roles, tenant membership and catalog grants. Catalog permissions resolve to reader, writer or admin. Ownership identifies the tenant that holds the physical data. See Catalog sharing for the current grant workflow and limits.

Use the superadmin interface for storage configuration, identity providers and user administration. Keep storage credentials and deployment encryption keys separate from short-lived client tokens.

MFA and SSO

Use the dashboard to manage the MFA methods enabled for your account and to review active sessions. Store recovery codes outside the device used for sign-in.

For SAML setup, use the Entra ID guide. Provider and local login behavior depends on the deployment's policy; a server upgrade or a different installation may expose different options.

Troubleshooting

Symptom	Check
PGWire authentication fails	Vend a fresh credential; use its returned host, port and catalog
Catalog is not found in DuckDB	List authorized catalogs and explicitly attach the correct UUID
Access is denied	Check the requesting user's membership, role and catalog grant
HTTP ingestion rejects a token	Use the ingest purpose, the correct topic and the exact returned token
SSE rejects a token	Use the stream purpose and check expiry or revocation
TLS connection fails	Check the hostname, certificate chain and trusted CA; do not bypass verification

Use Configuration for deployment settings and Authentication and authorization for credential types.