--- title: Built-in authentication and authorization for Manticore... description: Manticore Search now includes built-in authentication and authorization starting with the 27.x release line. The feature covers SQL/MySQL clients... canonical: https://daily.dev/posts/built-in-authentication-and-authorization-for-manticore-search-a3bx7spfu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Built-in authentication and authorization for Manticore Search | daily.dev og:description: Manticore Search now includes built-in authentication and authorization starting with the 27.x release line. The feature covers SQL/MySQL clients... og:url: https://daily.dev/posts/built-in-authentication-and-authorization-for-manticore-search-a3bx7spfu og:image: https://api.daily.dev/og/posts/a3bX7sPfU.png og:image:alt: Built-in authentication and authorization for Manticore Search og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Built-in authentication and authorization for Manticore Search **[Manticore](https://daily.dev/sources/manticoresearch)** · 4 min read · 17 upvotes · 1 comments ## Summary Manticore Search now includes built-in authentication and authorization starting with the 27.x release line. The feature covers SQL/MySQL clients (username/password), HTTP clients (Basic auth or Bearer tokens), distributed remote agents, and replication operations. The authorization model defines five actions — read, write, schema, replication, and admin — applied to named targets or wildcards. This replaces common workarounds like putting nginx in front of Manticore for access control. For SaaS and shared search deployments, it enables per-user permission boundaries, audit logging, and compliance-friendly controls (GDPR, SOC 2). Rollout guidance is provided: auth is disabled by default, and existing deployments should update clients and test before enabling in production. Distributed topologies should upgrade remote agents and replication peers before enabling auth on masters. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does authentication work in Manticore Search 27.1.5? Manticore Search 27.1.5 introduces built-in authentication and authorization across SQL/MySQL clients, HTTP/HTTPS clients, distributed remote agents, and replication operations. SQL clients authenticate with a username and password, while HTTP clients use Basic authentication or Bearer tokens. Permissions are granted using five actions: read, write, schema, replication, and admin, applied against named or wildcard targets like table names. _Teams rolling out Manticore Search auth can track release specifics like this on daily.dev._ ### Is authentication enabled by default when I upgrade Manticore Search? No, authentication is disabled by default until explicitly configured. Once enabled, clients that fail to send credentials will be rejected, so applications should be updated and tested for expected denials before switching production traffic over. For distributed or replicated setups, remote agents and replication peers should be upgraded before the masters, with auth enabled only once the whole topology runs a compatible version. _Anyone planning a security rollout can follow migration guidance like this on daily.dev._ ### What permission model does Manticore Search use for authorization? Manticore Search authorization uses five actions: read for search and read-only access, write for data changes, schema for table and schema management, replication for cluster operations, and admin for managing authentication and authorization itself. Targets can be specific names or wildcards, such as products, logs_*, or *, letting operators scope permissions per table or cluster. _Developers comparing database access-control models can dig into details like these on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@pdfopsdev** · 0 upvotes > good to see this land as first-class — we ran Elasticsearch behind an nginx sidecar for years just for basic auth, and the moment ES shipped native security half our infra complexity disappeared. curious if Manticore's audit logging is query-level or just connection-level. ## Similar posts on daily.dev - [How to secure Manticore Search with built-in authentication and authorization](https://daily.dev/posts/how-to-secure-manticore-search-with-built-in-authentication-and-authorization-vlgkdvilf) · Manticore · 1 upvotes · 0 comments - [Manticore Search 27.1.5: Authentication, sharded tables, conversational search and faster vector search](https://daily.dev/posts/manticore-search-27-1-5-authentication-sharded-tables-conversational-search-and-faster-vector-sea-vaeuj65j7) · Manticore · 2 upvotes · 0 comments - [Manticore Search authentication rollout checklist for production](https://daily.dev/posts/manticore-search-authentication-rollout-checklist-for-production-zxwohhayt) · Manticore · 1 upvotes · 0 comments - [Manticore Search 25.0.0](https://daily.dev/posts/manticore-search-25-0-0-xaked8brj) · Manticore · 0 upvotes · 0 comments - [Manticore Search 2025 recap](https://daily.dev/posts/manticore-search-2025-recap-jn95zfcje) · Manticore · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#authorization](https://daily.dev/tags/authorization), [#manticore-search](https://daily.dev/tags/manticore-search) [View this post on daily.dev](https://daily.dev/posts/built-in-authentication-and-authorization-for-manticore-search-a3bx7spfu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Built-in authentication and authorization for Manticore Search","url":"https://daily.dev/posts/built-in-authentication-and-authorization-for-manticore-search-a3bx7spfu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/built-in-authentication-and-authorization-for-manticore-search-a3bx7spfu"},"datePublished":"2026-07-16T11:33:12.358Z","dateModified":"2026-09-14T07:38:00.789Z","description":"Manticore Search now includes built-in authentication and authorization starting with the 27.x release line. The feature covers SQL/MySQL clients...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/45065133ec559a9fe385433bfce91291?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/45065133ec559a9fe385433bfce91291?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Manticore","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Manticore","logo":"https://media.daily.dev/image/upload/s--FP5Ea08h--/f_auto/v1754225081/logos/manticoresearch","url":"https://daily.dev/sources/manticoresearch"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/built-in-authentication-and-authorization-for-manticore-search-a3bx7spfu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":17},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"authentication,authorization,manticore-search","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Manticore","item":"https://daily.dev/sources/manticoresearch"},{"@type":"ListItem","position":3,"name":"Built-in authentication and authorization for Manticore Search"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/built-in-authentication-and-authorization-for-manticore-search-a3bx7spfu","comment":[{"@type":"Comment","text":"good to see this land as first-class — we ran Elasticsearch behind an nginx sidecar for years just for basic auth, and the moment ES shipped native security half our infra complexity disappeared. curious if Manticore’s audit logging is query-level or just connection-level.","datePublished":"2026-07-16T18:05:18.887Z","url":"https://daily.dev/posts/a3bX7sPfU#c-4HXVxw09c","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/built-in-authentication-and-authorization-for-manticore-search-a3bx7spfu#faq","mainEntity":[{"@type":"Question","name":"How does authentication work in Manticore Search 27.1.5?","acceptedAnswer":{"@type":"Answer","text":"Manticore Search 27.1.5 introduces built-in authentication and authorization across SQL/MySQL clients, HTTP/HTTPS clients, distributed remote agents, and replication operations. SQL clients authenticate with a username and password, while HTTP clients use Basic authentication or Bearer tokens. Permissions are granted using five actions: read, write, schema, replication, and admin, applied against named or wildcard targets like table names. Teams rolling out Manticore Search auth can track release specifics like this on daily.dev."}},{"@type":"Question","name":"Is authentication enabled by default when I upgrade Manticore Search?","acceptedAnswer":{"@type":"Answer","text":"No, authentication is disabled by default until explicitly configured. Once enabled, clients that fail to send credentials will be rejected, so applications should be updated and tested for expected denials before switching production traffic over. For distributed or replicated setups, remote agents and replication peers should be upgraded before the masters, with auth enabled only once the whole topology runs a compatible version. Anyone planning a security rollout can follow migration guidance like this on daily.dev."}},{"@type":"Question","name":"What permission model does Manticore Search use for authorization?","acceptedAnswer":{"@type":"Answer","text":"Manticore Search authorization uses five actions: read for search and read-only access, write for data changes, schema for table and schema management, replication for cluster operations, and admin for managing authentication and authorization itself. Targets can be specific names or wildcards, such as products, logs_*, or *, letting operators scope permissions per table or cluster. Developers comparing database access-control models can dig into details like these on daily.dev."}}]} ```