Credential Profiles

One username and password, shared by any number of connections

Rotating a database password used to mean opening every connection that used it. Create one profile in Settings > Profiles, point those connections at it, and the next rotation is a single edit.

Create a profile

Settings > Profiles

1. Open Settings > Profiles

   Credential Profiles is the first section.

2. Click Add Credential Profile…

   Give it a name, a username, and pick where the password comes from.

3. Click Create

   Every connection’s Credentials picker now offers it.

Save These as a Profile… on a connection that already has credentials filled in does the same thing without retyping them.

Point a connection at one

The Credentials picker on a connection's Authentication section

Credentials sits at the top of the Authentication section. Enter Below is the default and keeps today’s behavior: the username and password belong to that connection alone. Picking a profile replaces both fields with a read-only summary, and the connection signs in with whatever the profile holds at the moment it connects.

A linked connection keeps no password of its own. Linking deletes the one it had, so an encrypted export of it carries nothing and Duplicate copies the link rather than the secret.

Where the password comes from

Source	What happens on connect
Saved in the Keychain	Read from the Keychain, under the profile’s own id
Ask every time	Asked for once per profile each time TablePro runs, however many connections use it
~/.pgpass	Looked up by the host, port, database and username of whichever connection is opening
Read from elsewhere	Resolved from a file, an environment variable, a command’s output, 1Password, Vault or AWS Secrets Manager

Pick Saved in the Keychain unless something else already owns the password. Read from elsewhere never leaves this Mac and never syncs.

Additional secrets

Some engines sign in with more than a password: an AWS secret access key, a Snowflake private key, a service account JSON. Additional Secrets in the profile editor lists them per database type. A connection reads only the secrets its own type declares, so one profile can carry several engines’ keys without them colliding.

Rename, duplicate and delete

Right-click a row in Settings > Profiles for Edit… and Duplicate. The row’s trailing label says how many connections use it.

Delete Profile is at the bottom of the editor. Deleting hands the username and the password to each connection that used it, as that connection’s own credentials, so nothing stops connecting. Two profiles cannot share a name, since every picker offers them by name alone.

Sharing and sync

An exported connection carries its profile by name, alongside the name, the username and where the password comes from. Importing on a Mac that has no profile of that name creates one set to ask for the password; a profile already there is left as it is and the connection links to it. The password never travels, and a profile reading its password from a file or a command exports as one that asks.

With iCloud Sync on, Settings > Sync > Credential Profiles carries profiles between your Macs: the name, the username, and where the password comes from. The password and any additional secrets stay in the Keychain. They cross only while Passwords is on in the same pane, and only when saved after it was turned on. A profile set to Read from elsewhere arrives as Ask every time, and a source set on the second Mac stays on that Mac.

Which connections use a profile is kept on each Mac, so pick the profile in Credentials again on the second one. A profile arriving under a name already taken gets a number after it, such as prod (2). Deleting a profile deletes it on your other Macs too.