Auth, OAuth, and API keys

Keys and roles

Each project has keys that your apps use to call our APIs. The anon (or publishable) key is meant for browsers and is limited by Row Level Security. The service_role key bypasses RLS. Treat service_role like a root password: server-side only, never in a mobile app or public repo.

OAuth consent is the grant

Sign in with WoWSQL and MCP connections show a consent screen with the app name, scopes, and project. Clicking Allow is your authorization. We do not send your WoWSQL password or database password to that app.

You can revoke a connection from the dashboard where we expose that control. Until you revoke it, the app may use the scopes you approved. Third-party apps are not WoWSQL. Their terms and security are theirs.

Team access

People you invite can read or change the project according to the role you give them. Remove people who should not have access. We will not guess who should still be on the team.

Leaked credentials

If a key, cookie, or OAuth token leaks, rotate it. Unauthorized use with valid credentials is your risk, not a failure of our isolation. We may suspend keys we believe are being abused.