Using Retool to write directly in the db

💬 App Building
1

This is more a question about using Retool for the right use case rather than technical.
I'm a fan of Retool because it allows me write simple apps rapidly, just by knowing the data model. Everywhere I go I recommend it. But I'm consistently challenged due to the fact that I need to use a user with write permissions, and this opens a window to the database.
I understand those concerns, but at the same time I know a pretty common use case is apps that write data back into the db, not just read.
So my question is:

  • is there a best practice that I'm missing here?
  • Or how can I appease the ones concerned about security?

Thanks!

2

Hi @i52sacaa,

Welcome to the Retool community!

Retool is fairly secure, even the cloud version. In the permissions settings, you can create groups that only access the given apps you need them to. You can set it to use here and further lock down the resources and workflows. It allows the users to use the app, which may write to the database but only within the parameters you set.

chrome_ad5DOTIOaz
chrome_ad5DOTIOaz692×412 24.4 KB

I also use the "Additional" tab where you can push a user straight to their home app, remove access to the Query library, audit logs, etc.

chrome_nTNVsrC5af
chrome_nTNVsrC5af1495×592 41.6 KB

Hope this helps and reassures you!

3

Thanks for reaching out, @i52sacaa! Note that some of the functionality that @Shawn_Optipath described above requires a Business plan. That said, you don't even need to connect to Retool with a write-enabled user. If you or those that you work with can find value in Retool as a read-only dashboard, then that's a totally valid use case. Are there any other aspects of this that I can address? Don't hesitate to ask!

4

Have you had a chance to review this, @i52sacaa? No worries if not, I just wanted to check in before closing the topic. :+1:

5

We are, for now, using a dedicated user for Retool with specific permissions at db level. So we didn't use Retool's user management capabilities.

6

That makes sense and is what I was alluding to above. :+1: Glad to hear you're found a functional solution that makes everybody happy.