> ## Documentation Index
> Fetch the complete documentation index at: https://helix-isolate-failing-index-entities.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Authenticate requests, handle API keys, and review encryption and enterprise security features

<div className="flex flex-wrap gap-2"><Badge color="gray" size="sm">Reference</Badge></div>

## Direct gateway authentication

All API requests to Helix Cloud are authenticated with a Bearer token. Tokens are managed
through the Helix dashboard. Include the token in the `Authorization` header of every request:

```
Authorization: Bearer <token>
```

The SDK clients attach this header for you—set the key once with `withApiKey`
(TypeScript), `with_api_key` (Rust and Python), or `WithAPIKey` (Go). See the
[cross-language Cloud connection example](/database/helix-cloud/start-here/working-with-enterprise#connect-and-send-a-request).

Requests without a valid token are rejected at the gateway before reaching any database node.
Token rotation and revocation take immediate effect from the dashboard.

The Helix CLI does not use these application keys. Cloud CLI operations authenticate with a rotating
WorkOS session, and Cloud CLI queries execute through the backend broker. Interactive MCP uses WorkOS
OAuth for human sessions and the WorkOS agent registration flow for agents. The unified MCP endpoint
also accepts workspace-owned service credentials with explicit project grants for query and customer administration tools. These sessions do not receive Cloud discovery
or observability tools. Service credentials also support headless HTTP API calls. See the
[MCP access matrix](/database/helix-cloud/connect/mcp).

## Encryption

All traffic between clients and the gateway is encrypted in transit via TLS. Data at rest in
object storage is encrypted using the storage provider's server-side encryption.

## Coming soon

These enterprise security features are on the [roadmap](/database/helix-db/start-here/roadmap)
and are not yet available. Contact [founders@helix-db.com](mailto:founders@helix-db.com)
if your deployment depends on one of them.

* **Role-based access control.** Fine-grained API key permissions beyond today's
  read-only and read-write keys, for least-privilege credentials per service or
  environment.
* **SSO / SAML.** Dashboard access through your identity provider (Okta, Azure AD, Google Workspace)
  with centralized provisioning and deprovisioning.
* **Audit logs.** Per-request logging (timestamp, token identity, query name, source IP, response
  status) for compliance (SOC 2, HIPAA, GDPR) and forensic analysis.
* **AWS PrivateLink.** A private endpoint in your VPC that routes to Helix Cloud without traversing
  the public internet, for network-isolation requirements in regulated environments.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.