Store the secret in the protected field
A database URI often contains a username, password, host, and database name. When saving the connection through the SDK, place the URI under `endpoint.credentials`, following the documented connection shape. The separate `endpoint.uri` field is kept as plain text and should not contain a password or other secret.
The connection setup call records configuration; it does not prove that the database is reachable or that the credentials work. After saving, run a small read-only operation against the intended database to validate connectivity and permissions. Keep the full URI out of logs, screenshots, support tickets, and FAQ examples.
Limit access and handle changes carefully
Use a database user with only the permissions the application needs, and choose a connection label that does not expose sensitive information. Avoid sharing a saved connection more broadly than required. If a credential may have been exposed, rotate it with the database provider and update the saved connection through the approved settings.
When diagnosing a failure, share the provider, operation, timestamp, and a sanitized error instead of the URI. Confirm the database name and network access separately from authentication, since each can fail for a different reason. Encryption at rest protects the stored credential field, but it does not make it safe to reveal the secret in prompts or copied diagnostic text.