Databases

Create a read-only user. In mongosh, against the database the tickets are about:

db.getSiblingDB("admin").createUser({
  user: "triagic",
  pwd: "…",
  roles: [{ role: "read", db: "orders" }]
})

Note which database the user is defined in — that is the authSource, and it is the commonest cause of a rejected login.

Assemble the connection string, including that auth source: mongodb+srv://triagic:…@cluster0.abc.mongodb.net/orders?authSource=admin. For Atlas, add the machine's egress IP to the cluster's IP access list first.

Fill the form.

Verify. The desktop proves the credential with list-databases before reporting running.

Create a read-only role.

CREATE ROLE triagic LOGIN PASSWORD '…';
GRANT CONNECT ON DATABASE billing TO triagic;
GRANT USAGE ON SCHEMA public TO triagic;
GRANT SELECT ON ALL TABLES IN SCHEMA public TO triagic;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO triagic;

The last line is the one people forget: without it, tables created later are invisible.

Fill the form.

Verify. Health check is SELECT 1.

Create a read-only user.

CREATE USER 'triagic'@'%' IDENTIFIED BY '…';
GRANT SELECT ON shop.* TO 'triagic'@'%';

Fill the form. This one takes the parts, not a URL.

Verify. Health check is SELECT 1 through the execute_sql tool.

Create a restricted ACL user so a cached-value lookup cannot become a FLUSHALL:

ACL SETUSER triagic on >… ~* +@read +@keyspace

Fill the form.

Verify. Health check lists keys matching a pattern that matches nothing, so it proves the connection without reading data.

Create a read-only user.

CREATE USER triagic IDENTIFIED BY '…' SETTINGS readonly = 1;
GRANT SELECT ON events.* TO triagic;

Fill the form.

Verify. Health check is list_databases.

Create a service user whose default role can only read. The connector never sends a role, so the user's DEFAULT_ROLE is what applies — there is no role field on this form.

CREATE ROLE triagic_reader;
GRANT USAGE ON WAREHOUSE analytics_wh TO ROLE triagic_reader;
GRANT USAGE ON DATABASE prod TO ROLE triagic_reader;
GRANT USAGE ON ALL SCHEMAS IN DATABASE prod TO ROLE triagic_reader;
GRANT SELECT ON ALL TABLES IN DATABASE prod TO ROLE triagic_reader;
CREATE USER triagic PASSWORD = '…' DEFAULT_ROLE = triagic_reader;
GRANT ROLE triagic_reader TO USER triagic;

It must be a password user: SSO and MFA accounts cannot sign in here.

Fill the form.

Verify. Health check is list-databases.

Create a service account with exactly two roles: BigQuery Data Viewer (roles/bigquery.dataViewer) to read, and BigQuery Job User (roles/bigquery.jobUser) to run queries. Nothing else.

Download its JSON key and place it on the machine that runs Triagic — an absolute path readable by the desktop app, e.g. /opt/triagic/bigquery-sa.json. Skip this if that machine already has Application Default Credentials configured.

Fill the form.

Verify. Health check is list-tables.

Create an IAM user with AmazonDynamoDBReadOnlyAccess, or a policy granting dynamodb:List*, dynamodb:Describe*, dynamodb:Query, dynamodb:Scan and dynamodb:GetItem on the tables you need. Generate an access key for it.

Fill the form.

Verify. No health check runs for this one: the underlying tool returns AWS errors as successful results with an error field, so a check could not tell a working credential from a denied one. It is start-checked only — the first real tool call is what proves the credential.

Generate a personal access token at supabase.com/dashboard/account/tokens. It inherits its owner's organization access, so create it from an account that is a member of the organization owning the project — ideally a dedicated one.

The project's anon and service_role keys are a different credential and are not accepted here.

Find the project ref. Project Settings → General → Reference ID, a 20-character string. It is also the subdomain of the project's …supabase.co URL.

Fill the form.

Verify. Health check is list_tables, which runs real SQL through the platform API, so it fails on both a bad token and a project the token cannot reach.