Authentication & Secrets

Authentication by Engine

Engine	Supported methods
MongoDB	None, SCRAM-SHA-256, SCRAM-SHA-1 (for legacy servers)
PostgreSQL	None, username/password
SQL Server	None, SQL login (username/password), Windows authentication
Aerospike	Optional username/password
ClickHouse	Username/password

MongoDB notes

SCRAM-SHA-256 is the modern default; SCRAM-SHA-1 exists for the legacy 3.6/4.0 servers Sutido still supports. If your user lives in a different database than the one you're querying (commonly admin), set the auth database accordingly — a pasted URI's authSource option is picked up automatically.

SQL Server notes

Windows authentication uses your current Windows session — no password stored at all. Encryption and trust-server-certificate are configurable per connection.

How Secrets Are Stored

Database passwords, SSH keys and passphrases, and AI API keys are encrypted with OS-level encryption (Electron's safeStorage, backed by your Windows account) and kept in Sutido's local secret store. What this means in practice:

• Nothing sensitive ever sits in plaintext on disk
• Secrets never leave your machine — there is no cloud sync and no account required
• Exported connection URIs don't include stored passwords

Troubleshooting

Authentication failed

• Check username and password with the engine's own CLI first
• MongoDB: verify the auth database — a user created in admin can't authenticate against mydb unless you say so
• SQL Server: confirm whether the server expects SQL logins, Windows auth, or both

Works locally, fails on the server

Remote servers often restrict where connections may come from (firewalls, pg_hba.conf, IP allow-lists). Check the server-side rules — see Hosted Databases for the cloud-provider specifics.

Next Steps

Connecting to Atlas, RDS, or another managed service? Continue with Hosted Databases.