Turso

Overview

Use Turso credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Property	Value
Provider ID	turso
Category	Database
Credential Type	Database Auth Token

Step 1: Get Credentials

Log in to the Turso Dashboard

Log in to the Turso Dashboard.

Create a token

Open the database and, under Connect, click Create Token (or run turso db tokens create <database>, adding --read-only for a read-only token).

Copy the token

Choose full-access or read-only and copy the token.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add Turso

Go to Managed Secrets > Add Provider > Turso.

Enter credentials

Paste your Database Auth Token into the credential field.

Enter the deployment endpoint

Paste your Database HTTP URL — copy it from the Turso dashboard (also shown by turso db show). Alter derives this credential’s allowed hosts from that exact host, so proxied calls can only ever reach your deployment. The allowlist cannot be widened or edited separately; rotate the credential with a new endpoint to retarget it.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.POST,
    "https://YOUR-DATABASE-YOUR-ORG.turso.io/v2/pipeline",
    grant_id="YOUR_GRANT_ID",
    json={
        "requests": [
            {"type": "execute", "stmt": {"sql": "SELECT * FROM users LIMIT 5"}},
            {"type": "close"},
        ]
    },
)

Notes

• Database tokens authorize the per-database HTTP API. Turso Platform API tokens are separate.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
pipeline	admin, delete, read, write	POST	/v2/pipeline
dump	read	GET	/dump
listen	read	GET	/beta/listen
jobs/list	read	GET	/v1/jobs
jobs/get	read	GET	/v1/jobs/{id}
health	read	GET	/health
version	read	GET	/version