# Authentication and network access

Every native connection authenticates a configured username and password before SQL is accepted. HTTP supports Basic authentication, Bearer API keys, or the explicitly configured default user with an empty password when no Authorization header is present.

## Credentials

`users.xml` declares users and their credentials. A user has one password form and can also have one API-key digest for HTTP. Usernames are case-sensitive. Changes require a server restart.

Invalid explicit HTTP credentials do not fall back to the default user. Permissions, roles and settings profiles are not implemented.

## Transport and listeners

CoordinatorDB has no built-in TLS listener. Credentials travel without TLS, so choose trusted connectivity or an external secure transport for the intended deployment.

The listeners bind the configured host and ports. The sample uses loopback for local access. See [network ports](https://coordinatordb.com/docs/concepts/features/security/network-ports) for overrides and [configuration files](https://coordinatordb.com/docs/concepts/features/configuration/server-config/configuration-files) for credential examples.