Rocketadmin
DEVELOPER · DEVELOPER
Database connections, their tables, and the rows inside them in the account they connected.
Connecting Rocketadmin in practice
Rocketadmin fronts a real database, so what a caller can touch is whatever the connection’s Cedar policies allow, and a user who belongs to two groups gets the higher of the two permission levels rather than the stricter one. Policies name actions like RocketAdmin::Action::"table:read" against resources written as connectionId/table, every row-level endpoint in the reference is tagged API+, and the plan comparison lists API access only from the paid Team plan upward.
Scopes that draw scrutiny
API key (generated in Account settings)Created in the dashboard, shown once and used for the REST API and the Zapier integration. It is the credential that reaches table rows through the API+ endpoints.Master password (client-side encryption)When a connection is created with client-side encryption, Rocketadmin does not store the key on its servers — it lives only in the user’s browser and has to be distributed to every authorized user, so no server-side caller opens that connection without being handed it.Agent connection tokenThe token a self-hosted rocketadmin-agent Docker container uses to reach the database. Reloading or leaving the agent configuration screen regenerates it, invalidating the one already deployed.Admin group policiesAdmin group permissions cannot be edited at all; narrowing access means creating a new group with its own Cedar or form-built policies.
Worth knowing
- A direct connection requires running Rocketadmin’s generated grant statements so their servers can reach your database, whereas an agent connection keeps the database private behind a container you run — a materially different trust boundary chosen at creation time.
- Cedar resources for tables and dashboards must name the connection id too (RocketAdmin::Table::"1234/products"), and the ids come out of the dashboard URL rather than an endpoint.
- Connection log endpoints default to a limit of 500 records when pagination is not used, so an audit pull silently truncates.
- Resetting client-side encryption means toggling it off and on again, which issues a new key and locks out every user still holding the old one until you tell them.
Checked against Permissions reference (2026-09-29), Master password (2026-09-29), How to create an API key (2026-09-29), API reference (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Rocketadmin behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.