Register and approve connectors
How to register a company database as a connector, and approve who can query how much of it with grants.
This is how you open a database your company uses so apps can query it.
Do two things — register the connection and approve access — and from then on approved people pull the data from their own apps.
AxHub holds the credentials, so app code never contains the company DB password.
What you need
- Company admin rights — only admins can register connectors and approve access
- CLI login — the command tool whose commands start with
axhub
Registering the connection
Register the company database as a connector. Google Drive can be connected straight from the terminal.
axhub connectors google start # get the browser authorization URL
axhub connectors google finalize # create the connector after authorizingRunning discovery builds the list of tables and resources the connector holds. You need that list before you can approve a scoped grant.
axhub connectors discover <connector_id> --executeAn AxHub app's own DB can be opened as a connector too. Use it when you want others to query the data one app has accumulated.
axhub connectors app-db eligible-apps # apps that can be opened
axhub connectors app-db create --app-id <app> --executeApproving access (grants)
A connector alone gets you nothing: without approval, nobody can query it. You approve by deciding four things in a grant.
| What you decide | Detail |
|---|---|
| Who | subject — a person, a group, an org unit |
| Which connector | one of the connectors you registered |
| Which action set | preset — read-only, for instance |
| (Optional) Which table scope | with a scope set, everything outside it is unreachable |
Setting a scope blocks free-form SQL. A scoped grant can't run arbitrary queries (403 scope_requires_target), and reaching outside the scope gives 403 scope_out_of_range. It's the switch between opening things wide and locking them down.
Confirm the grant landed from the account you approved.
axhub authz grants mine # their active grants
axhub connectors mine # connectors they can query
axhub connectors resources <connector_id> # that connector's resource treeA connector without a grant doesn't even appear in the list. When a developer says "I can't see the connector," approval hasn't happened yet.
How queries stay controlled
After approval, three layers of protection sit on every query.
| Safeguard | What it does |
|---|---|
| Allowed actions only | Only actions the grant's preset allows run at all. The default read-only preset lets through read queries like SELECT, WITH, and EXPLAIN |
| Safe queries | Values travel separately from the SQL, and every query is written to the audit log along with whether it was allowed or denied |
| Temporary sessions | Queries only run inside a gateway session, and sessions close automatically after 8 hours |
You've succeeded when
axhub connectors mine shows the connector from the account you approved. From there, each person queries it from their own app following Connect company data with a connector.