Skip to content

Organizations and tokens

Everything on PlanetScale belongs to an organization: its databases and their branches, its members, and its bill. There are two kinds of access to keep apart. A deploy credential lets Alchemy create and change databases. A database credential lets your app connect to one branch.

Sign in with a profile

Section titled “Sign in with a profile”

Alchemy reaches an organization through a profile:

Terminal window
alchemy profile edit --add Planetscale

OAuth signs you in through the browser, and Alchemy refreshes the session for you. Or store a service token: a token that belongs to the organization, not to a person, carrying the permissions you give it. Alchemy deploys into the organization in your profile: the one your service token belongs to, or the one you pick when you sign in with OAuth. See Setup.

One profile per organization

Section titled “One profile per organization”

A stage decides what you deploy. A profile decides where. If production lives in its own organization, give it its own profile:

Terminal window
alchemy profile create prod
alchemy profile edit --profile prod --add Planetscale
alchemy deploy --stage prod --profile prod

Within one organization, stages get their own branches, so a pull request never touches production’s data.

Database credentials

Section titled “Database credentials”

Your app never holds the deploy token. It connects with credentials that reach one branch, and only as far as their role allows: a Postgres role inherits Postgres’s own roles, and a MySQL password carries a role like readwriter. Give a reporting job a read-only credential and the API a read-write one. See Credentials.

In CI

Section titled “In CI”

With CI=true, Alchemy skips the profile and reads PLANETSCALE_API_TOKEN_ID, PLANETSCALE_API_TOKEN and PLANETSCALE_ORGANIZATION from the environment. Use a service token there, so it outlives anyone’s login. See CI.