You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* chore(docs): restructure security docs and enhance API Keys documentation
Separated Users and Roles & Privileges into dedicated pages for better organization. Completely rewrote API Keys documentation with detailed instructions for creating, managing, and using API keys. Cleaned up navigation structure and removed duplicate content.
* docs: update OffSync page for v1.5.0 UI redesign
- Remove outdated video imports (old UI recordings)
- Add Enabling/Disabling OffSync section with dialog flow
- Rewrite Configuration tab: Database ID + SQL snippet + Push Notifications
- Add Metrics tab section (active devices, upload/download bytes)
- Update intro to reflect 4-tab layout
* docs: add enable/disable OffSync video to offsync page
* docs: remove obsolete section "Advanced: RLS and SQLite Sync"
* docs: enhance OffSync documentation for Database ID and Push Notifications configuration
* docs: comment out video player for OffSync enable/disable functionality
---------
Co-authored-by: Andrea Donetti <andinux@gmail.com>
description: SQLite Cloud provides secure access to resources through role-based authorization, which ensures user isolation and enhances security and manageability.
3
+
description: Manage API Keys for secure application access, server-to-server communication, and SDK integration.
4
4
category: platform
5
5
status: publish
6
6
slug: apikey
7
7
---
8
8
9
-
## API KEYs
10
9
11
10
API KEYs can be used as an alternative authentication mechanism.
12
11
Authentication through API keys ensures the same privileges as the user to which they are associated.
13
12
API KEYs are recommended for all server-to-server authentication cases and are necessary for using the REST APIs and the SDKs that uses the WebSocket APIs.
14
13
15
-
To create an API key for a user, click on the **Create API KEY**button.
14
+
You can manage all keys in your cluster via the SQLite Cloud Dashboard under the **API Keys**section.
You can create an API Key and immediately assign it to any existing user in your cluster.
21
+
22
+
1. Navigate to the **API Keys** section in the left sidebar.
23
+
2. Click the **Create API Key** button.
24
+
3.**API Key Name:** Enter a descriptive name to identify the key (e.g., `MobileApp_Prod`, `Backend_Worker`).
25
+
4.**User:** Select the user this key will impersonate from the dropdown list.
26
+
5.**Expiration:**
27
+
* Select **Never expires** for long-running services.
28
+
* Select **Set expiration date** to enforce a rotation policy or for temporary access tokens.
29
+
6. Click **Create**.
30
+
31
+
[VIDEO: create_apikey_global.mp4]
32
+
{/* <!-- Video showing the global creation flow: entering a name, selecting a user from the dropdown, picking a date, and creating --> */}
33
+
34
+
---
35
+
36
+
## Managing API Keys
37
+
38
+
The API Keys list provides a centralized view of all active keys, their associated users, and expiration status.
39
+
40
+
### Regenerating a Key
41
+
If a key is lost, forgotten, or you suspect it has been compromised (leaked), you should regenerate it immediately.
42
+
43
+
1. Find the key in the list.
44
+
2. Click the context menu (three dots) on the right.
45
+
3. Select **Regenerate**.
46
+
4. Confirm the action in the modal window.
47
+
48
+
**Warning:** Regenerating a key invalidates the old key string immediately. You must update any applications or scripts using the old key with the new value to restore connectivity.
49
+
50
+
[VIDEO: regenerate_apikey.mp4]
51
+
{/* <!-- Video showing the regenerate flow and the confirmation modal --> */}
52
+
53
+
### Editing and Deleting
54
+
***Edit:** Allows you to rename the key or change its expiration settings without changing the key string itself.
55
+
***Delete:** Permanently revokes the key. Applications using this key will no longer be able to connect.
56
+
57
+
[VIDEO: delete_apikey.mp4]
58
+
{/* <!-- Video showing the delete action --> */}
59
+
60
+
---
61
+
62
+
## Using API Keys
63
+
64
+
Once generated, the API Key is typically used in the connection string of your SQLite Cloud client or SDK.
65
+
66
+
The standard format for a connection string using an API Key is:
67
+
```
68
+
sqlitecloud://<host>:<port>?apikey=<your-api-key>
69
+
```
70
+
71
+
When using the REST API directly, the key should be passed in the Authorization header:
18
72
19
-
The resulting table will display all the API keys associated with each user, along with their name.
20
-
@@ -31,35 +28,65 @@ OffSync extends standard SQLite tables with built-in support for offline work an
31
28
When combined with [Row-Level Security (RLS)](/docs/rls), OffSync allows you to build secure, multi-tenant applications where each user's data is safely isolated, both on the edge and in the cloud.
32
29
33
30
34
-
---
31
+
---
35
32
36
33
## Configuring OffSync
37
34
38
-
You can enable and manage OffSync for your databases directly from the SQLite Cloud dashboard.
39
-
Below are the main steps:
35
+
You can enable and manage OffSync for your databases directly from the SQLite Cloud dashboard.
36
+
The OffSync panel has four tabs: **Sync Tables**, **Configuration**, **Devices**, and **Metrics**.
37
+
38
+
### Enabling and Disabling OffSync
39
+
40
+
When OffSync is not yet active for a database, the panel shows a brief explanation and an **Enable OffSync** button. Clicking it opens a confirmation dialog; after confirming, the database is registered with the sync service and the tabbed view appears.
41
+
42
+
To disable OffSync, click the **Disable OffSync** button in the top-right corner of the panel and confirm the action in the dialog that appears.
43
+
44
+
{/* <VideoPlayer src={enableDisableSync} /> */}
40
45
41
46
### Enable Tables for Synchronization
42
-
From the **Sync Tables** tab, select which tables in your database you want to keep synchronized.
47
+
48
+
From the **Sync Tables** tab, select which tables in your database you want to keep synchronized.
43
49
Once enabled, all changes to those tables will automatically sync with connected devices.
44
50
45
-
<VideoPlayersrc={enableSync} />
51
+
{/* VIDEO: dashboard_offsync_sync_tables.mp4
52
+
Show: Sync Tables tab open → toggle one or more tables on → confirmation that sync is active for those tables. */}
53
+
54
+
### Configuration Tab
46
55
56
+
The **Configuration** tab contains two sub-sections:
47
57
48
-
### Get the Connection String
49
-
In the **Configuration** tab, copy the connection string.
50
-
Use this in your application to initialize OffSync and connect your local SQLite database with SQLite Cloud.
58
+
**Database ID** — A read-only field showing the unique identifier for your OffSync-enabled database, with a copy button for convenience. Use this ID in your application to initialize the sync connection (see the <ahref="https://github.com/sqliteai/sqlite-sync"target="_blank">sqlite-sync README</a> for more details):
51
59
52
-
<VideoPlayersrc={connectionUrlSync} />
60
+
```sql
61
+
SELECT cloudsync_network_init('<database-id>');
62
+
```
53
63
64
+
**Push Notifications** — Push notifications work out of the box. If you have enabled Expo enhanced security, provide your access token here. This is only required when using the `sqlite-sync-react-native` library with push mode enabled — the token adds an extra layer of security to prevent unauthorized push notifications.
65
+
66
+
{/* VIDEO: dashboard_offsync_configuration.mp4
67
+
Show: Configuration tab open → Database ID field with copy button clicked → scroll down to Push Notifications section → paste an Expo token → save → status changes to "Working". */}
54
68
55
69
### Manage Connected Devices
56
-
In the **Devices** tab, you can view all devices currently connected to your database.
70
+
71
+
In the **Devices** tab, you can view all devices currently connected to your database.
57
72
Here you can check their sync status and remove devices if needed.
58
73
59
-
<VideoPlayersrc={devicesSync} />
74
+
{/* VIDEO: dashboard_offsync_devices.mp4
75
+
Show: Devices tab open with a list of connected devices → inspect sync status of one device → remove a device from the list. */}
60
76
61
77
<Callouttype="note"title="Matching Schemas and Tables">
62
78
For OffSync to work correctly, the list of tables configured for synchronization—and their corresponding schemas—must be identical in both your local SQLite database and your SQLite Cloud database.
63
79
</Callout>
64
80
81
+
### Metrics Tab
82
+
83
+
The **Metrics** tab provides visibility into daily and cumulative usage for your OffSync-enabled database:
84
+
85
+
-**Active devices** — number of devices that have synced within the period
86
+
-**Upload bytes** — data sent from devices to SQLite Cloud
87
+
-**Download bytes** — data sent from SQLite Cloud to devices
88
+
89
+
{/* VIDEO: dashboard_offsync_metrics.mp4
90
+
Show: Metrics tab open → scroll through active devices chart → upload bytes chart → download bytes chart, ideally with some non-zero data visible. */}
91
+
65
92
Once enabled, any changes made to the selected tables via the SQLite Sync extension will be automatically synchronized with your SQLite Cloud database.
Copy file name to clipboardExpand all lines: sqlite-cloud/platform/pub-sub.mdx
-1Lines changed: 0 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,6 @@ status: publish
6
6
slug: pub-sub
7
7
---
8
8
9
-
# SQLiteCloud Pub/Sub System
10
9
11
10
**Publish/Subscribe (Pub/Sub)** is a messaging pattern that enables asynchronous communication between multiple applications. In the context of **SQLiteCloud**, Pub/Sub provides a robust way to deliver real-time updates or custom messages to subscribed clients when data changes or explicit notifications are issued.
Copy file name to clipboardExpand all lines: sqlite-cloud/platform/rls.mdx
-21Lines changed: 0 additions & 21 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -254,24 +254,3 @@ OLD.status <> 'paid'
254
254
255
255
**Explanation:**
256
256
This policy uses the `OLD` reference to check the value of the `status` column *before* the update is applied. If the status is already `'paid'`, the condition `OLD.status <> 'paid'` will be false, and the `UPDATE` operation will be denied. This effectively makes paid invoices read-only.
257
-
258
-
259
-
---
260
-
261
-
## Advanced: RLS and SQLite Sync
262
-
263
-
When using RLS in conjunction with <ahref="https://github.com/sqliteai/sqlite-sync"target="_blank">SQLite Sync</a>, it's important to understand how they interact. The Sync protocol applies changes on a column-by-column basis, which can affect how `INSERT` and `UPDATE` policies are evaluated.
264
-
265
-
To accommodate this, SQLite Cloud offers two modes for handling RLS during sync operations, configurable via the `rls_mode` server setting using the SQLite Cloud builtin command `SET KEY rls_mode TO <value>`.
266
-
267
-
#### Default Mode (`rls_mode = 1`)
268
-
269
-
To simplify policy creation for the most common use cases, the default mode does **not** enforce `INSERT` and `UPDATE` policies while applying changes from SQLite Sync.
270
-
271
-
Instead, after the sync operation is complete, the `SELECT` policy is used to validate the final state of the row. If the user does not have permission to view the resulting row, the entire transaction is rolled back. This ensures that users cannot introduce changes that they are not allowed to see.
272
-
273
-
#### Manual Policy Mode (`rls_mode = 0`)
274
-
275
-
For more complex scenarios, such as implementing separate read/write permissions or restricting write access to specific columns, you can set `rls_mode` to `0`.
276
-
277
-
In this mode, your `INSERT` and `UPDATE` policies are enforced for every incremental change applied by SQLite Sync. Because of Sync's column-by-column operation, your policies must be written to permit intermediate states. This means the policies must allow `NEW` values for non-primary key columns to be temporarily set to their default values during the sync process.
0 commit comments