Skip to main content
There are three separate access decisions when you connect a source:
  1. Provider permissions: what the external account, key, or app is allowed to access.
  2. Connection settings: which host, database, bucket, site, or account Dawn is configured to use.
  3. Import settings: which query, path, range, or date window a particular run requests.
A narrow import does not reduce the underlying credential’s permissions. For example, selecting one spreadsheet does not turn an account-wide OAuth scope into access to only that spreadsheet.

​
Access by integration

Use the provider guides for setup details. Where a provider offers broader administrative roles, prefer a dedicated account with the permissions required for your particular import.

​
Read access and write access

Reading data for an import and exporting data back to a source are different operations. Dawn also supports export workflows for some sources. A credential with write permissions may enable those workflows even if your first pipeline only reads data. Database credentials should therefore be restricted at the database itself when you need a read-only integration. For APIs, an HTTP method alone does not guarantee that an endpoint is read-only; check the provider’s endpoint behaviour. Google describes the reach of its Sheets scopes. Microsoft explains that storage account keys grant broad storage access. Treat those access models as part of your decision to connect the source.

​
Store credentials

Use Connections → Credentials, or create a credential from the connection form. Saved credential values stay hidden in the connection interface. Give each credential a useful name, such as sales_warehouse_reader, without including its secret value. Use separate credentials where sources need different permissions or ownership. Record who manages the provider account and when its access needs review.

​
Rotate or revoke access

  1. Identify every connection and workflow using the credential.
  2. Create or authorise a replacement credential in Dawn.
  3. Edit each affected connection to select the replacement.
  4. Verify a small import or source inspection.
  5. Revoke the old key, password, app grant, or token at the provider after dependent workflows have migrated.
  6. Remove the unused Dawn credential when it is no longer needed.
For an urgent revocation, revoke at the provider immediately and expect dependent runs to fail until reconfigured. Disabling a connection does not revoke the provider credential. Deleting a credential from Dawn does not delete imported datasets, dashboards, or reports.

​
When access fails

  • Authentication error: check expiry, the selected account, the credential type, and whether the provider grant was revoked.
  • Permission error: check access to the specific table, object, site, or account as well as general API access.
  • Timeout: check the hostname, endpoint, firewall, and network route with your administrator.
  • Discovery works but import fails: check permissions for the actual query or file and its full data volume.
Share the error and source type with support, but omit passwords, tokens, and private keys.