Remote Connectivity Security

SecurityConnectivityAuth TokensTLS

Stable On by default · production-ready

What it is

When a cluster runs beyond localhost, you secure the connection on two axes: transport (encrypt the link with TLS) and authentication (prove who is calling). AetheriusDB gates the native and Flight SQL endpoints with bearer auth tokens: when a token is configured on the server, every client must present it before any SQL is accepted.

You set the required token at daemon start; clients pass the matching token when they connect. A request without the token — or with the wrong one — is refused before it reaches the engine.

Why it matters

• Tokens, not embedded passwords — require a single bearer token on the native and Flight SQL listeners instead of scattering credentials.
• Per-protocol control — the native and Flight SQL endpoints take their own tokens, so you can enable auth where it matters and disable the listeners you don’t use.
• One connection call — clients pass the token at connect time; no separate login round-trip to manage.

How you use it

1. Require a token on the server

Set the token when starting aetheriusd (or via the matching environment variable):

aetheriusd \
  --native-auth-token "my-bearer-token" \
  --flight-auth-token "my-flight-token"

# Or via environment variables:
export AETHERIUS_NATIVE_AUTH_TOKEN="my-bearer-token"
export AETHERIUS_FLIGHT_AUTH_TOKEN="my-flight-token"

If you do not use a listener, you can turn it off entirely with --disable-flight or --disable-native.

2. Pass the token from the client

import aetherius

# Native protocol with a bearer token.
with aetherius.connect("db.example.com", 5679,
                       auth_token="my-bearer-token") as conn:
    conn.execute("SELECT 1")

A connection that omits the token, or presents the wrong one, is rejected before any statement runs.

Key concepts

Term	Meaning
Bearer auth token	A shared secret a client must present to connect; configured per listener on the server.
TLS	Transport encryption for the link between client and cluster. Use it for any connection that leaves a trusted network.
Listener	A protocol endpoint (native, pgwire, Flight SQL). Each can be enabled, disabled, or token-gated independently.

Notes & caveats

Tip

Use a distinct token per listener (--native-auth-token and --flight-auth-token), and keep tokens out of source control — pass them through the environment variables (AETHERIUS_NATIVE_AUTH_TOKEN / AETHERIUS_FLIGHT_AUTH_TOKEN) so they never land in shell history or config files.

Tokens protect access, not the wire by themselves

A bearer token authenticates the caller, but a token sent over an unencrypted link can be observed. Always terminate the connection over TLS when it crosses an untrusted network, so the token and your data are both encrypted in transit.

Connect a Client →

Connection recipes with and without auth tokens.

Wire Protocols →

The native, pgwire, and Flight SQL endpoints you are securing.

RBAC & Row-Level Security →

Once connected, control what each role can see.