PlanetScale

Connect PlanetScale to collect infrastructure evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In PlanetScale:

   1. In the PlanetScale dashboard for your organization, go to Settings › Service tokens.
   2. Click New service token, enter a name, and click Create service token.
   3. Copy both the service token ID and the token value from the modal. There's no way to retrieve the token value once you leave this page.
   4. Click Edit token permissions for the new token.
   5. In the Organization access section, click Add organization permissions, check read_organization and click Save permissions.
   6. In the Database access section, click Add database access, select each database Safeguard should read, check read_database, read_branch and read_backups, and click Save permissions.

   Where to find the other values:

   • Organization: Your PlanetScale organization name (the same value the CLI takes with --org). The fetched docs do not say where the dashboard displays it.
   • Service token ID: Shown in the modal next to the token value right after Create service token.
   • Access token (optional): Not documented on the fetched pages (alternative to a service token).

   PlanetScale shows the secret only once, so copy it before you leave the page.

   PlanetScale's public documentation does not cover every step.

   Permission names come from PlanetScale's service token reference. Where the dashboard displays the organization name was not found in the fetched pages (the API uses it in /v1/organizations/ORGANIZATION_NAME/...).

   Source: planetscale.com, planetscale.com, checked 2026-10-07.

   The permissions Safeguard needs: read_organization, read_database, read_branch, read_backups. Safeguard's compliance tests for PlanetScale need the credential on the API token tab: an OAuth connection cannot read everything they check.

2. On Compliance › Connectors, open PlanetScale, click Connect, choose API token and fill in:

   Field	What to enter
   Organization	Optional.
   Service token ID	Optional.
   Service token	Optional. Stored encrypted and never shown again.

   Or, instead: Access token (optional).

3. Click Connect with token.

Frameworks

Safeguard's automated tests read PlanetScale and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Infrastructure connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks