> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamnative.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Machine-to-Machine Access

> Create a dedicated SQLWorkspace engine identity for an application or automated workload.

For applications and automation, an engine administrator can manually create a dedicated SQLWorkspace engine user and grant only the privileges that the workload requires. The application then uses that engine identity to connect through the [native PostgreSQL endpoint](/sql/get-started/console/connect-postgresql-client).

## Create an engine user

The following example creates an engine user and grants read-only access to the managed sources in one schema:

```sql theme={null}
CREATE USER m2m_app WITH PASSWORD '<strong-password>';

GRANT CONNECT ON DATABASE "<database>" TO m2m_app;
GRANT USAGE ON SCHEMA "<schema>" TO m2m_app;
GRANT SELECT ON ALL SOURCES IN SCHEMA "<schema>" TO m2m_app;
```

Grant table, materialized-view, or write privileges only when the workload needs them. Do not grant `SUPERUSER` for routine application access.

For supported privileges and commands, see [Access control in RisingWave](https://docs.risingwave.com/operate/access-control).

## Use OAuth authentication

For token-based machine-to-machine authentication, RisingWave supports engine users configured with `CREATE USER ... WITH oauth`. The OAuth configuration identifies a JSON Web Key Set (JWKS) endpoint and issuer, and RisingWave validates the token header and claims when the client connects.

| SQLWorkspace engine | Credential                 | Required engine configuration                                                                                         |
| ------------------- | -------------------------- | --------------------------------------------------------------------------------------------------------------------- |
| RisingWave          | StreamNative Cloud API key | Create an engine user with `CREATE USER ... WITH oauth` and configure the matching JWKS endpoint, issuer, and claims. |

You can use a StreamNative Cloud API key with this authentication flow. An engine administrator must first create an OAuth-authenticated engine user whose JWKS endpoint, issuer, and claim requirements match the API key. Creating a StreamNative Cloud service account does not automatically create this engine user.

For the required configuration, token claims, audience validation, and SQL syntax, see [Create a user with OAuth authentication](https://docs.risingwave.com/sql/commands/sql-create-user#syntax-for-creating-a-user-with-oauth-authentication) in the RisingWave documentation.

## Connect through the native endpoint

Configure the application with the SQLWorkspace native hostname, port `4567`, target database, engine username, password or OAuth credential, and certificate-verifying TLS mode. For the complete connection fields, see [Connect with a PostgreSQL Client](/sql/get-started/console/connect-postgresql-client).

## Manage the identity lifecycle

Manually created engine users are not managed through StreamNative Cloud role bindings. You are responsible for:

* Storing and rotating their passwords or OAuth credentials securely.
* Reviewing and changing their engine privileges.
* Revoking access or dropping the user when the workload no longer needs access.

Do not place a password or OAuth token in a connection URI, shell history, application log, or screenshot. Require TLS with certificate and hostname verification for native connections.