ReportPlaneDocs
WebsiteOpen console

Security model

Understand ReportPlane security as layered identity, resource scope, network policy, and warehouse isolation.

Last verified 2026-08-02

ReportPlane security is layered. No single hostname, token, certificate, or IP address is expected to solve every access problem.

Four questions for every runtime request

  1. Who is calling? A client, API key, JWT subject, or certificate identity.
  2. How did they prove it? A secret, signature, certificate chain, or supported combination.
  3. What may they access? Allowed data models or Analytics APIs.
  4. Under what conditions? Enabled state, CIDRs, identity binding, access filters, time windows, and quotas.

Separate management and runtime access

Human accounts use the console. Automation configures the control plane with scoped Management Tokens. Runtime applications send or query data with ingest clients, query clients, or runtime API Keys. Do not give automation a human password, and never interchange management and runtime credentials.

Separate write and read

Ingest clients authorize writing to data models. Query clients authorize executing Analytics APIs. API keys can have one or both capabilities, but the allowed resource lists remain separate.

Protect warehouse credentials

External connection secrets are stored as Credentials and referenced by destinations. Runtime applications do not receive them. Workspace-shared credentials require elevated workspace authorization because their impact can cross projects.

Network and TLS topology

The control-plane API uses the proxied app.reportplane.com origin. Public ingest and query runtime domains terminate TLS in ReportPlane so customer mTLS certificates can be validated. They must not be placed behind an HTTP proxy that removes the client TLS session.

Operational principles

  • use one identity per application trust boundary;
  • choose least-privilege model or analytics scopes;
  • layer CIDR with cryptographic identity when possible;
  • rotate secrets without reusing them across environments;
  • disable compromised clients immediately;
  • keep secrets out of payloads, URLs, logs, and documentation.
Management tokensAutomate control-plane configuration with explicit scopes.Runtime API keysCreate ingest/query identities with explicit capabilities.mTLSAuthenticate clients with certificates.JWTValidate signed runtime tokens.CIDR restrictionsLimit source networks as an additional control.
Was this page helpful?Send feedback