> ## Documentation Index
> Fetch the complete documentation index at: https://docs.truestate.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Permissions and credentials

> Understand the difference between a selected data source and the access granted to Dawn.

There are three separate access decisions when you connect a source:

1. **Provider permissions:** what the external account, key, or app is allowed to access.
2. **Connection settings:** which host, database, bucket, site, or account Dawn is configured to use.
3. **Import settings:** which query, path, range, or date window a particular run requests.

A narrow import does not reduce the underlying credential's permissions. For example, selecting one spreadsheet does not turn an account-wide OAuth scope into access to only that spreadsheet.

## Access by integration

| Integration           | Authentication used by the connector                    | Access to arrange for an import                                                                                                              |
| --------------------- | ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| Google Sheets         | Google OAuth                                            | The `spreadsheets.readonly` scope; not limited to the selected spreadsheet.                                                                  |
| Postgres / SQL Server | Username and password                                   | A dedicated login with access to the database and read access to required tables or views.                                                   |
| Snowflake             | Username and password, with optional role and warehouse | A role with database/schema access, table or view read access, and permission to use the warehouse.                                          |
| BigQuery              | Google service account key                              | Query-job access in the execution project and read access to source data; see the [database guide](/integrations/databases#google-bigquery). |
| Amazon S3             | AWS access key ID and secret                            | Bucket listing plus object reads for the required data; additional key access may be needed for encrypted objects.                           |
| Google Cloud Storage  | Google service account key                              | Object listing and reads on the source bucket.                                                                                               |
| Azure Blob Storage    | Storage account name and key                            | The connector uses Shared Key access, which is broader than container-only read access.                                                      |
| SharePoint            | Entra application client ID and secret                  | Microsoft Graph application permissions and access to the target site and document library.                                                  |
| Salesforce            | Application client ID and secret                        | API access and the integration user's object, field, and record permissions.                                                                 |
| LinkedIn              | OAuth access token                                      | Dawn requests `r_ads` and `r_ads_reporting`; access also depends on the authorised account.                                                  |
| REST API / custom     | Provider-specific credential                            | Match the credential permissions to the endpoints and operations you intend to use.                                                          |

Use the provider guides for setup details. Where a provider offers broader administrative roles, prefer a dedicated account with the permissions required for your particular import.

## Read access and write access

Reading data for an import and exporting data back to a source are different operations. Dawn also supports export workflows for some sources. A credential with write permissions may enable those workflows even if your first pipeline only reads data.

Database credentials should therefore be restricted at the database itself when you need a read-only integration. For APIs, an HTTP method alone does not guarantee that an endpoint is read-only; check the provider's endpoint behaviour.

Google describes the reach of its [Sheets scopes](https://developers.google.com/workspace/sheets/api/scopes). Microsoft explains that [storage account keys](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage) grant broad storage access. Treat those access models as part of your decision to connect the source.

## Store credentials

Use **Connections → Credentials**, or create a credential from the connection form. Saved credential values stay hidden in the connection interface. Give each credential a useful name, such as `sales_warehouse_reader`, without including its secret value.

Use separate credentials where sources need different permissions or ownership. Record who manages the provider account and when its access needs review.

## Rotate or revoke access

1. Identify every connection and workflow using the credential.
2. Create or authorise a replacement credential in Dawn.
3. Edit each affected connection to select the replacement.
4. Verify a small import or source inspection.
5. Revoke the old key, password, app grant, or token at the provider after dependent workflows have migrated.
6. Remove the unused Dawn credential when it is no longer needed.

For an urgent revocation, revoke at the provider immediately and expect dependent runs to fail until reconfigured. Disabling a connection does not revoke the provider credential. Deleting a credential from Dawn does not delete imported datasets, dashboards, or reports.

## When access fails

* **Authentication error:** check expiry, the selected account, the credential type, and whether the provider grant was revoked.
* **Permission error:** check access to the specific table, object, site, or account as well as general API access.
* **Timeout:** check the hostname, endpoint, firewall, and network route with your administrator.
* **Discovery works but import fails:** check permissions for the actual query or file and its full data volume.

Share the error and source type with support, but omit passwords, tokens, and private keys.