Skip to main content
Every connection to Airhouse authenticates as a user, and every user has one role. Airhouse checks the role on every statement before the statement reaches the query engine.

​
Authentication

Airhouse uses SCRAM-SHA-256 password authentication, the same mechanism as modern PostgreSQL. Standard drivers support it out of the box. Credentials come from one of three places: Passwords for database users and minted credentials are stored as SCRAM verifiers, never in plain text.

​
Roles

A statement your role doesn’t allow is rejected with SQLSTATE 42501 before it runs:
Writers can’t create, alter, or drop tables. Have an admin create the tables your pipelines write to, or mint a schema-scoped writer, which may run DDL inside its own schemas.
Follow least privilege: give dashboards and analysts reader, give ingestion pipelines writer, and keep admin for the people who manage table structure.

​
When a role can’t be determined

If Airhouse can’t determine the role for a session (for example, because the credential expired or was revoked before the session’s first query), it closes the connection rather than running with reduced privileges. Reconnect with a valid credential. Your driver’s normal reconnect logic handles this.

​
TLS

When the server has a certificate and key configured (see [tls] in the configuration reference), clients can connect over TLS:
Use sslmode=require or stricter in every client that connects over a network you don’t control.

​
Static users for self-hosted setups

When you run Airhouse without the Admin API, you can define users in the configuration file:
airhouse.toml
Or with the AIRHOUSE_USERS environment variable, as comma-separated name:password:role entries:
If you manage users with the Admin API, don’t also define static users. Static users are checked first and aren’t tied to a single database.
Name every user you intend to admit. With static users configured, a username that isn’t in the list can’t run queries. If no users are configured at all and the Admin API isn’t enabled, any username that presents the server’s default password ([auth] password, or AIRHOUSE_PASSWORD) connects with full admin rights. Only run that way on your own machine.