Team features

Single sign-on. Settings → Single sign-on: your identity provider’s issuer URL, client ID and secret (any OpenID Connect provider: Keycloak, Authentik, Dex, Google, Microsoft Entra ID, Okta…), with the redirect URI to register there. The login page then shows “Sign in with …”. People are matched to accounts by email when the provider has verified it; new people get the role you choose, from the domains you allow. SSO only turns password sign-in off for everyone but the owner, who keeps it as a way back in.

API tokens. Settings → API tokens: a token for scripts and CI (Authorization: Bearer wbt_…, or WB_TOKEN for wb). It acts as you, with at most the access its scope allows (read, write or admin), and can expire. It’s shown once; revoke it any time.

Data masking. Database → Settings → Data masking: hide columns such as email or *_token from everyone but chosen roles. They show as ****, a***@example.com, a hash (equal values stay equal) or empty, in the grid, documents, views and exports, and by column name in SQL results. Masked columns can’t be filtered, sorted or edited. In SQL, renaming a column gets around the mask, so give people who must not see the values read-only access through views, not the SQL editor.

Write approvals. Settings → Discovery → “Writes to production need approval”. On databases tagged production, editors’ changes wait for an admin: in the grid, edits queue up and Request approval sends them; in the SQL editor, Request approval sends the script. Admins see requests under Settings → Approvals and Approve and run them (Wharfbase runs them then, through the requester’s connection, which must remember its password) or reject them with a reason. Admins write directly. Requests not decided in 7 days expire.

Audit export and stream. Settings → Audit log: download the log as CSV or NDJSON (each row with its hash, so the copy can be checked), and stream every new entry to a webhook (signed with a key you choose) or to syslog over UDP, TCP or TLS. If the target is down, entries wait and go out in order when it’s back.