> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pawsql.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> PawSQL 是一个产品：Cloud 是公网部署形态，Engine / Optimizer / Auditor / Advisor / Patroller 是同一产品的组件与交付形态，不是彼此独立的产品。 / PawSQL is a single product: Cloud is the public deployment form, while Engine / Optimizer / Auditor / Advisor / Patroller are components and delivery forms of the same product, not separate products.
> 术语以站内术语表为准：SQL 审核对应英文 SQL Review，查询重写对应 Query Rewrite，索引推荐对应 Index Recommendation；英文内容统一用 Review，不用 Audit。 / Use the site glossary for terminology: 审核 is SQL Review, 重写 is Query Rewrite, 索引推荐 is Index Recommendation; English content uses Review, never Audit.
> 引用能力范围或版本支持时以对应页面为准；标注 unknown、或 status 非 published 的内容表示尚未经产品核实，不应作为事实引用。 / Cite capability scope and version support from the corresponding page; content marked unknown, or with a status other than published, is not yet product-verified and must not be cited as fact.

# Authentication

> Securely authenticate web, IDE, MCP, and API clients and understand how identity differs from authorization.

Authentication establishes who is connecting to PawSQL. Authorization then determines which organizations, projects, workspaces, and operations that identity can access.

| Concept        | Question answered | Examples                                        |
| -------------- | ----------------- | ----------------------------------------------- |
| Authentication | Who are you?      | Password, enterprise SSO, access token          |
| Authorization  | What may you do?  | View a workspace, create a review, manage rules |

If sign-in succeeds but a resource is missing, investigate authorization before resetting credentials.

## Goal

Learn how to authenticate web, IDE, MCP, and API clients and manage credentials and access tokens securely.

## Prerequisites

* A PawSQL account or the credentials issued by your administrator.
* The service endpoint for the PawSQL environment you connect to.

## Authentication by client

| Client        | Common method                                     | Notes                                      |
| ------------- | ------------------------------------------------- | ------------------------------------------ |
| Web console   | Account sign-in or enterprise SSO                 | Interactive use                            |
| IDE extension | Client credential supported by the release        | Browser state is usually separate          |
| PawSQL MCP    | Access token or configured service authentication | Supply through secure client configuration |
| OpenAPI       | Token or documented API authentication            | Intended for service-to-service calls      |
| Webhook       | Signature, token, or platform-specific mechanism  | Validate both origin and integrity         |

## Web sign-in

<Steps>
  <Step title="Open a trusted endpoint">Verify the domain and TLS certificate.</Step>
  <Step title="Authenticate">Use the login method shown by the service.</Step>
  <Step title="Confirm identity">Check the account, organization, and project after sign-in.</Step>
  <Step title="Confirm authorization">Verify that the required features and workspaces are visible.</Step>
</Steps>

## Manage access tokens

* Create separate tokens for IDE, MCP, CI/CD, and temporary testing.
* Use a name that identifies purpose and owner.
* Limit scope and lifetime.
* Store the value immediately in an approved secret manager.
* Rotate credentials on a defined schedule.
* Revoke a token as soon as it is no longer needed.

<Warning>
  Tokens may be shown in full only once. Never paste them into source code, ordinary configuration files, screenshots, documentation, or build logs.
</Warning>

## Credential storage order

1. Client or operating-system secure credential store.
2. CI/CD secret or enterprise vault.
3. Access-restricted environment configuration excluded from version control.
4. Avoid plaintext command-line arguments because they may appear in shell history or process inspection.

## Account hygiene

* Assign an individual account to each user.
* Review privileged and inactive accounts regularly.
* Revoke access when a user changes role or leaves a project.
* Treat suspected exposure as an incident: revoke first, replace the credential, and review audit records.

## Troubleshooting

| Symptom                                  | Check first                                                            |
| ---------------------------------------- | ---------------------------------------------------------------------- |
| Sign-in rejected                         | Endpoint, account, password, identity provider, system time            |
| Token rejected                           | Expiration, revocation, incomplete copy, wrong PawSQL environment      |
| Authentication succeeds but access fails | Organization membership, project role, workspace permission, license   |
| SSO returns to the login page            | Cookies, callback URL, domain, system time, identity-provider settings |

## Expected Result

After sign-in you see your account, organization, and project, and the features and workspaces your role permits are visible.

## Verification

Confirm the displayed account, organization, and project match your expectations, and that the required features and workspaces are visible before proceeding.

## Next steps

<CardGroup cols={2}>
  <Card title="Verify the installation" href="/en/user-guide/installation/verify-installation" />

  <Card title="Install IDE extensions" href="/en/user-guide/installation/ide-plugins" />

  <Card title="Configure PawSQL MCP" href="/en/user-guide/dev-tools/mcp" />
</CardGroup>