If sign-in succeeds but a resource is missing, investigate authorization before resetting credentials.
Goal
Learn how to authenticate web, IDE, MCP, and API clients and manage credentials and access tokens securely.Prerequisites
- A PawSQL account or the credentials issued by your administrator.
- The service endpoint for the PawSQL environment you connect to.
Authentication by client
Web sign-in
1
Open a trusted endpoint
Verify the domain and TLS certificate.
2
Authenticate
Use the login method shown by the service.
3
Confirm identity
Check the account, organization, and project after sign-in.
4
Confirm authorization
Verify that the required features and workspaces are visible.
Manage access tokens
- Create separate tokens for IDE, MCP, CI/CD, and temporary testing.
- Use a name that identifies purpose and owner.
- Limit scope and lifetime.
- Store the value immediately in an approved secret manager.
- Rotate credentials on a defined schedule.
- Revoke a token as soon as it is no longer needed.
Credential storage order
- Client or operating-system secure credential store.
- CI/CD secret or enterprise vault.
- Access-restricted environment configuration excluded from version control.
- Avoid plaintext command-line arguments because they may appear in shell history or process inspection.
Account hygiene
- Assign an individual account to each user.
- Review privileged and inactive accounts regularly.
- Revoke access when a user changes role or leaves a project.
- Treat suspected exposure as an incident: revoke first, replace the credential, and review audit records.