Access Control
VeloDB Cloud uses organizations as top-level boundaries and separate identity and permission systems for console access, Management API requests, and warehouse SQL connections. Choose the path or scope that matches what you need to control, then open the linked guide for setup and management details.
| Access path | Use it for | Identity or scope | Where to manage |
|---|---|---|---|
| Organization | Isolate members, warehouses, billing, and organization settings between teams or business units. | Organization | Organizations |
| Console access | Let people sign in to the VeloDB Cloud console and manage organization resources. | Organization member and organization role | Members, Multi-Factor Authentication, and SAML Single Sign-On |
| Management API access | Let automation call VeloDB Cloud management endpoints. | API key with an organization role | API Keys |
| Warehouse SQL access | Let people, applications, BI tools, and data pipelines connect to a warehouse and access SQL objects. | Warehouse user and warehouse SQL role | Warehouse Users and Roles |
How the access paths relate
Members manages console-level identities, the people you invite to your organization. A member's organization role (Organization Admin, Organization Billing, Warehouse Admin, Warehouse Viewer) controls what they can see and do in the console, not what SQL they can run. Premium organizations can use SAML Single Sign-On to authenticate members through a corporate identity provider.
Warehouse Users and Roles manages warehouse-level identities, the SQL accounts your data pipelines and BI dashboards use to run queries. These credentials appear in your connection string. The roles here are SQL roles scoped to the warehouse, which are separate from the organization roles assigned to Members.
Note:
- Console accounts, Management API keys, and warehouse users are separate credentials. A person who needs both console access and SQL access must be an organization member and have a warehouse user.
- An API key does not provide direct warehouse access.
Choose a guide
- To create or switch organizations, see Organizations.
- To invite people or assign console permissions, see Members.
- To require a second sign-in factor or connect an identity provider, see Multi-Factor Authentication and SAML Single Sign-On.
- To automate organization and warehouse management, see API Keys.
- To create SQL accounts or grant warehouse privileges, see Warehouse Users and Roles.