​

Team and Organization Connections

A team connection is one set of SQL Studio credentials that every member of a team inherits. Instead of asking each user to enter their own username and password for a database service, a team owner configures the credentials once on the team, and members run queries with them straight away. Organization-wide access uses the same mechanism. Organization is the root team in Collate, so a connection configured there is inherited by every user in the platform. No separate organization-level setting exists.

​

How Team Connections Fit Together

SQL Studio resolves credentials at three levels: The service configuration comes first. A team connection extends it, it does not replace it: the admin still decides whether SQL Studio is enabled for the service and which authentication type is used. See Admin Configuration for that step.

​

Prerequisites

Before configuring a team connection, confirm the following.

• The database service is configured for SQL Studio and Enabled. Team connections aren’t offered for services that an admin hasn’t set up.
• You are a platform admin, or an owner of the team you want to configure.
• You have credentials to share, typically a service account rather than a personal login.

​

Who Can Configure and View

The following permissions apply to a team connection. Nobody reads the stored credentials back, including admins. Collate masks passwords, private keys, and client secrets in every response, and the encrypted values never leave the server.

​

Configuring a Team Connection

Follow these steps to share credentials with a team.

1. Navigate to Settings > Team & User Management > Teams.
2. Select the team you want to configure.
3. Click the SQL Studio tab. The tab lists every database service that an admin has enabled for SQL Studio, with the authentication type and the current status of the team’s connection.

4. Click Configure on the service you want to share.
5. Enter the credentials for the service:
   • BigQuery: Private Key ID, Private Key, Client Email, and Client ID, all taken from the Service Account.
   • Snowflake: Username + Password, or Username + Private Key + Passphrase.
   • Trino, Redshift, PostgreSQL, and MSSQL: Username + Password.

6. Click Save.
7. Click Test Connection and wait for the status to become Active.

Each team has one connection per service. Configuring the same service again updates the existing credentials rather than creating a second connection.

​

Configuring an Organization-Wide Connection

To give every user in Collate access to a service with one shared set of credentials, configure the connection on the Organization team:

1. Navigate to Settings > Team & User Management > Teams.
2. Open the Organization team, the root of the team hierarchy.
3. Follow the same steps as Configuring a Team Connection.

Every user belongs to Organization, directly or through a team, so this connection reaches everyone. It is also the broadest level, so a connection on any team closer to the user is used instead. That makes Organization a good default: a low-privilege connection for everyone, with narrower connections on the teams that need more access.

​

How Collate Chooses Which Credentials To Use

Credentials live at three levels: your own, your team’s, and the Organization’s. Only Active connections are used, so SQL Studio skips one that is pending, expired, or not configured and looks at the next level. When you open a new query tab:

• If only one connection is active, SQL Studio uses it.
• If both a team connection and your own credentials are active, SQL Studio asks which to use, except from the landing page, where it selects the team connection.

Among teams, the team closest to you wins: Group, then Department, then Division, then BusinessUnit, then Organization. You inherit connections from your own teams and from every team above them, so an Organization connection reaches you even when your own team has none. For more information, see Team Structure in Collate.

​

Switching Between Connections

When more than one connection is available for a service, choose which one a query tab uses:

• From the SQL Studio landing page: open the service card’s menu and click Choose Connection.
• From an open query tab: select the current connection in the toolbar, then pick a different one.

The dialog lists every team connection available to you, then your own credentials. Select one and click Start New Session. The choice applies to that query tab, so different tabs query the same service through different credentials. The toolbar shows which connection the active tab is using.

​

When Two Teams Are Equally Specific

If you belong to two teams of the same type that both have a connection for the same service, for example two Groups, neither is more specific than the other, and Collate won’t guess. The Choose Connection dialog lists the tied teams so you pick one. Calls made directly to the API get an AMBIGUOUS_CREDENTIALS error listing the candidate teams, and you resolve it by passing the teamId of the team you want.

​

Team Connections and Authentication Types

The admin fixes the authentication type on the service, which determines whether sharing makes sense:

• Basic authentication is what team connections are built for. The team owner enters the shared credentials once, and members inherit them.
• Collate SSO and OAuth authenticate each user individually against the database provider, so every member authorizes with their own identity from SQL Studio. See User Authentication for that flow.

​

Updating, Testing, and Removing a Team Connection

All three actions live on the team’s SQL Studio tab:

• Update credentials: click Edit on the connection, enter the new values, and save. Run Test Connection afterwards so the status returns to Active.
• Test the connection: click Test to check the credentials against the service. Use this after a password rotation, or whenever members report failures. The SQL Studio tab shows the time of the last check.
• Delete the connection: click Delete. The credentials are removed and members lose access through this team. New query tabs fall back to a connection from a parent team, or to the member’s own credentials. Saved queries aren’t affected.

​

Troubleshooting

Use the following solutions to resolve common team connection problems.

​

Members Can’t Query the Service

Check these in order:

1. The team connection status is Active, not Not Configured, Pending, or Expired. Run Test Connection.
2. The service is still Enabled in the admin configuration.
3. The user is a member of the team, or of one of its child teams.

​

A Member Sees Their Own Credentials Being Used Instead of the Team’s

A query tab keeps the connection it was opened with, so a tab opened before the team connection existed still uses the member’s own credentials. The member switches that tab through Choose Connection, or deletes their personal connection from My Connections on their profile so new tabs use the team connection.

​

Multiple Team Credentials Available

Two teams of the same type both have a connection for this service. Select one through Choose Connection. To remove the choice permanently, delete the connection from one of the teams, or configure a connection on a more specific team.

​

The Service Isn’t Listed on the Team’s SQL Studio Tab

The tab only lists services that an admin has configured and enabled for SQL Studio. Ask your admin to complete Admin Configuration for the service.

​

Next Steps

• User Authentication: connect with your own credentials, and manage personal connections.
• Query Execution: write and run queries in SQL Studio.
• Admin Configuration: configure SQL Studio and choose the authentication type for a service.