Neon

Overview

Use Neon credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Template ID	neon
Category	Database
Credential Type	API Key

Step 1: Get Credentials

Log in to the Neon Console

Log in to the Neon Console.

Open API keys

Go to Account settings > API keys — or Organization settings for an org/project-scoped key.

Create a key

Click Create new API key and name it.

Copy the key

Copy the key (starts with napi_) — it is only shown once.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Neon

Go to Managed Secrets > Add Provider > Neon.

Enter credentials

Paste the API Key into the credential field.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.GET,
    "https://console.neon.tech/api/v2/projects",
    grant_id="YOUR_GRANT_ID",
)

Notes

• The Neon API manages projects, branches, computes, databases, and roles — ideal for provisioning an isolated Postgres branch per agent or per session.
• Running SQL uses the Postgres protocol or Neon’s serverless driver against the branch’s connection string, not this API key.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path	Notes
listProjects	read	GET	/projects	—
getProject	read	GET	/projects/{project_id}	—
createProject	write	POST	/projects	—
updateProject	write	PATCH	/projects/{project_id}	—
deleteProject	delete	DELETE	/projects/{project_id}	—
getConnectionURI	read	GET	/projects/{project_id}/connection_uri	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
listProjectBranches	read	GET	/projects/{project_id}/branches	—
getProjectBranch	read	GET	/projects/{project_id}/branches/{branch_id}	—
createProjectBranch	write	POST	/projects/{project_id}/branches	—
deleteProjectBranch	delete	DELETE	/projects/{project_id}/branches/{branch_id}	—
restoreProjectBranch	write	POST	/projects/{project_id}/branches/{branch_id}/restore	—
setDefaultProjectBranch	write	POST	/projects/{project_id}/branches/{branch_id}/set_as_default	—
listProjectBranchDatabases	read	GET	/projects/{project_id}/branches/{branch_id}/databases	—
getProjectBranchDatabase	read	GET	/projects/{project_id}/branches/{branch_id}/databases/{database_name}	—
createProjectBranchDatabase	write	POST	/projects/{project_id}/branches/{branch_id}/databases	—
updateProjectBranchDatabase	write	PATCH	/projects/{project_id}/branches/{branch_id}/databases/{database_name}	—
deleteProjectBranchDatabase	delete	DELETE	/projects/{project_id}/branches/{branch_id}/databases/{database_name}	—
listProjectBranchRoles	read	GET	/projects/{project_id}/branches/{branch_id}/roles	—
getProjectBranchRole	read	GET	/projects/{project_id}/branches/{branch_id}/roles/{role_name}	—
createProjectBranchRole	write	POST	/projects/{project_id}/branches/{branch_id}/roles	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
deleteProjectBranchRole	delete	DELETE	/projects/{project_id}/branches/{branch_id}/roles/{role_name}	—
getProjectBranchRolePassword	read	GET	/projects/{project_id}/branches/{branch_id}/roles/{role_name}/reveal_password	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
resetProjectBranchRolePassword	admin	POST	/projects/{project_id}/branches/{branch_id}/roles/{role_name}/reset_password	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
listProjectEndpoints	read	GET	/projects/{project_id}/endpoints	—
getProjectEndpoint	read	GET	/projects/{project_id}/endpoints/{endpoint_id}	—
createProjectEndpoint	write	POST	/projects/{project_id}/endpoints	—
updateProjectEndpoint	write	PATCH	/projects/{project_id}/endpoints/{endpoint_id}	—
deleteProjectEndpoint	delete	DELETE	/projects/{project_id}/endpoints/{endpoint_id}	—
startProjectEndpoint	write	POST	/projects/{project_id}/endpoints/{endpoint_id}/start	—
suspendProjectEndpoint	write	POST	/projects/{project_id}/endpoints/{endpoint_id}/suspend	—
listApiKeys	read	GET	/api_keys	—
createApiKey	admin	POST	/api_keys	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
revokeApiKey	admin, delete	DELETE	/api_keys/{key_id}	—
listProjectPermissions	read	GET	/projects/{project_id}/permissions	—
grantPermissionToProject	admin	POST	/projects/{project_id}/permissions	—
revokePermissionFromProject	admin, delete	DELETE	/projects/{project_id}/permissions/{permission_id}	—
listProjectOperations	read	GET	/projects/{project_id}/operations	—
getProjectOperation	read	GET	/projects/{project_id}/operations/{operation_id}	—
createOrgApiKey	admin	POST	/organizations/{org_id}/api_keys	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
createCredential	admin	POST	/projects/{project_id}/branches/{branch_id}/credentials	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
revealCredential	admin	POST	/projects/{project_id}/branches/{branch_id}/credentials/{token_id}/reveal	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
rotateCredential	admin	POST	/projects/{project_id}/branches/{branch_id}/credentials/{token_id}/rotate	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
createNeonAuthProviderSDKKeys	admin	POST	/projects/auth/keys	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
createNeonAuthOAuthClient	admin	POST	/projects/{project_id}/branches/{branch_id}/auth/oauth-provider/clients	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)
rotateNeonAuthOAuthClientSecret	admin	POST	/projects/{project_id}/branches/{branch_id}/auth/oauth-provider/clients/{client_id}/rotate_secret	refused by default: leaves the caller holding a provider credential (a credential_minting rule can allow it)