Gateway

Reach private databases with an outbound-only channel: installation, registration, credentials sealed for the Gateway, operations.

The Prynt Gateway is a small service you install on a server of your network that can reach your database. It opens only outbound connections to Prynt, runs the read-only queries of your templates next to the database and sends the results back. Your database is never exposed to the internet, and no inbound port, port forwarding or VPN is needed.

Why a gateway

Most ERP databases live on a private network, behind a firewall. Opening them to a cloud service would mean an inbound port, an allow-list to maintain and a database reachable from the internet. With the Gateway the direction is reversed: the Gateway calls Prynt, over HTTPS on port 443, exactly like a browser. It is the recommended way to connect any database that is not already a managed cloud database (for those, see direct connections).

How it works

Registration. In Prynt you add a gateway and get a one-time registration token, valid for 15 minutes. On the server, the Gateway registers with it, generates its own key pairs (ECDSA P-256 to authenticate, ECDH P-256 to receive credentials) and sends Prynt only the public keys. The private keys never leave the server; Prynt stores only a hash of the token.
Connection. The Gateway keeps a WebSocket open to the Prynt API (wss://, path /api/v1/gateway/connect). At every connection Prynt sends a random challenge and the Gateway answers by signing it with its private key: there is no shared secret to steal. A heartbeat every 20 seconds keeps the connection alive; after a drop, the Gateway reconnects with an increasing delay, up to one minute.
Signed requests. Every request from Prynt (run a query, read the catalog, test a connection) is signed with the platform's key, which the Gateway pinned at registration, expires within minutes and is accepted once. A request that is not signed by Prynt is refused, even if someone could talk to the Gateway.
Defense in depth. The Gateway checks again that every statement is read-only with the SQL parser of the database dialect, and enforces its own limits on rows, bytes, timeout, concurrent requests and schemas, whatever the cloud asks. It keeps a local audit of every request (the statement's hash, never data or parameter values).

One gateway can serve several data sources and environments of the workspace. A gateway supports Oracle and PostgreSQL data sources.

Credentials sealed for the gateway

When you enter the database user and password in a data source connection that uses a gateway, your browser encrypts them with that gateway's public key before sending them: Prynt Cloud stores a sealed envelope it cannot decrypt, and only that gateway can open it, only for the connection it was sealed for. The page says so: Encrypted for this gateway — Prynt cannot read it.

The envelope uses ECIES: an ephemeral ECDH P-256 key agreement, HKDF-SHA256 and AES-256-GCM, bound to the data source and the environment. Browsers can do this only on HTTPS pages (WebCrypto).
On the server, the Gateway's keys and credentials are encrypted at rest: with DPAPI (machine scope) on Windows, in a folder readable only by Administrators, SYSTEM and the installing user; with AES-256-GCM and a key file readable only by the service user on Linux and in containers.
Alternatively, set the credentials on the Gateway itself with prynt-gateway credentials set: they never pass through Prynt at all and take precedence over the sealed envelope.

Requirements

Windowsx64 / ARM64: Windows PowerShell 5.1 or later, run as Administrator. Installed as the PryntGateway service.
Linuxx86_64 / aarch64: systemd, curl or wget, sha256sum, tar; root to install. Installed as the prynt-gateway service.
Dockerlinux/amd64: Any Docker host; the image is loaded from Prynt, no registry needed.
Networkoutbound 443: HTTPS and WebSocket to the Prynt API host, plus the database port inside your network. Nothing inbound.

Requirements of the Prynt Gateway
Field	Type	Description
`Windows`	x64 / ARM64	Windows PowerShell 5.1 or later, run as Administrator. Installed as the PryntGateway service.
`Linux`	x86_64 / aarch64	systemd, curl or wget, sha256sum, tar; root to install. Installed as the prynt-gateway service.
`Docker`	linux/amd64	Any Docker host; the image is loaded from Prynt, no registry needed.
`Network`	outbound 443	HTTPS and WebSocket to the Prynt API host, plus the database port inside your network. Nothing inbound.

The packages are self-contained (no .NET to install) and are served by Prynt itself, each with its SHA-256. The Gateway connects directly: it has no setting for an outbound HTTP proxy, so the server needs direct outbound access to the API on port 443. Keep the server's clock synchronized: signed requests carry an expiration time.

Install

1. Add a gateway in Prynt

Open Gateways in a workspace (permission datasources.manage: owners, admins and developers) and choose Add gateway. Give it a name that says where it runs. The dialog shows the one-time token (once, with its expiration) and the install commands for Windows, Linux and Docker with the API address and the token already filled in. Copy them from the dialog: the examples below show their shape.

2a. Windows

In Windows PowerShell opened with Run as administrator:

Windows · PowerShell (Administrator)PowerShell

[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor 3072; & ([scriptblock]::Create((Invoke-WebRequest -UseBasicParsing 'https://api.prynt.it/downloads/gateway/install.ps1').Content)) -Url 'https://api.prynt.it' -Token '<TOKEN>'

The script picks x64 or ARM64, downloads the package from Prynt and verifies its SHA-256 (nothing is installed on a mismatch), installs it in C:\Program Files\Prynt\Gateway, registers the Gateway with the token passed only through the process environment (never on a command line or in the output), and creates the PryntGateway service with automatic start and restart on failure. Options: -Version, -InstallDir, -DataDir, -NoService, -Force, -Uninstall [-RemoveData].

2b. Linux (systemd)

Linux · shellShell

curl -fsSL 'https://api.prynt.it/downloads/gateway/install.sh' | sudo bash -s -- --url 'https://api.prynt.it' --token '<TOKEN>'

The script verifies the SHA-256, installs the binary in /opt/prynt-gateway, creates the system user prynt-gateway with its data in /var/lib/prynt-gateway (mode 0700), registers as that user and enables the prynt-gateway systemd unit, which runs hardened (no new privileges, read-only system, private temp). Options: --version, --install-dir, --data-dir, --no-service, --force, --uninstall [--purge].

2c. Docker

DockerShell

curl -fsSL 'https://api.prynt.it/downloads/gateway/latest/docker' | docker loaddocker run -d --name prynt-gateway --restart unless-stopped --read-only \  -v prynt-gateway:/var/lib/prynt-gateway \  -e PRYNT_GATEWAY_URL='https://api.prynt.it' -e PRYNT_GATEWAY_TOKEN='<TOKEN>' \  prynt/gateway:<version>

The image archive comes from Prynt, so the host needs no registry access. The container registers at its first start and keeps its identity in the prynt-gateway volume: keep the volume when you recreate the container. Check it with docker exec prynt-gateway /opt/prynt-gateway/prynt-gateway status.

3. Wait for Online

Within seconds the gateway appears as Online in the dialog and in the list (the page refreshes every 10 seconds). If the token expires first, choose New registration token from the gateway's menu: the previous token stops working.

High availability

Install two or more gateways on different servers. Two processes sharing the same identity are not active–active: the second one waits as a standby and takes over when the first stops.

Use it in a data source

In a data source, configure the connection of an environment, choose Prynt Gateway and the gateway, then enter host, port, service name (Oracle) or database (PostgreSQL) as the gateway sees them on your network (for example erp-db.local or 10.0.0.12), and the user and password of a read-only database user. Save connection also tests it through the gateway.

Configuration

Limits are set in prynt-gateway.json, next to the executable (C:\Program Files\Prynt\Gateway, /opt/prynt-gateway). They apply on top of the limits of Prynt: the stricter one wins. Restart the service after a change; an update keeps your file and writes the new defaults to prynt-gateway.json.new.

prynt-gateway.jsonJSON

{  "Gateway": {    "MaxRows": 200000,    "MaxBytes": 268435456,    "MaxTimeoutSeconds": 900,    "MaxConcurrentRequests": 8,    "AllowedSchemas": [],    "SessionIdleSeconds": 600,    "AuditRetentionDays": 90  }}

MaxRowsinteger: Maximum rows a query may return (default 200,000).
MaxBytesinteger: Maximum size of a query's result in bytes (default 256 MiB).
MaxTimeoutSecondsinteger: Upper bound of a query's timeout (default 900 seconds).
MaxConcurrentRequestsinteger: Requests processed at the same time (default 8).
AllowedSchemasstring[]: Schemas the gateway may read; empty = whatever the database user can see. Limits the database explorer and the current schema too.
SessionIdleSecondsinteger: Idle read sessions are closed after this many seconds (default 600).
AuditRetentionDaysinteger: Days of local audit files kept (default 90).

Settings of prynt-gateway.json
Field	Type	Description
`MaxRows`	integer	Maximum rows a query may return (default 200,000).
`MaxBytes`	integer	Maximum size of a query's result in bytes (default 256 MiB).
`MaxTimeoutSeconds`	integer	Upper bound of a query's timeout (default 900 seconds).
`MaxConcurrentRequests`	integer	Requests processed at the same time (default 8).
`AllowedSchemas`	string[]	Schemas the gateway may read; empty = whatever the database user can see. Limits the database explorer and the current schema too.
`SessionIdleSeconds`	integer	Idle read sessions are closed after this many seconds (default 600).
`AuditRetentionDays`	integer	Days of local audit files kept (default 90).

The identity, keys, local credentials and audit files live in the data folder: %ProgramData%\Prynt\Gateway on Windows, /var/lib/prynt-gateway on Linux and in the container (--data-dir or PRYNT_GATEWAY_HOME to change it). The audit is written to audit/yyyy-MM-dd.jsonl. Back up this folder, or plan to register a new gateway if the server is lost.

Command line

prynt-gatewayText

prynt-gateway register --url <API_URL> --token <TOKEN> [--force]prynt-gateway runprynt-gateway statusprynt-gateway credentials set <DATA_SOURCE> [--username <user>] [--password-stdin]prynt-gateway credentials listprynt-gateway credentials remove <DATA_SOURCE>prynt-gateway rotate-keyprynt-gateway --version

registercommand: Registers with a one-time token (or PRYNT_GATEWAY_URL and PRYNT_GATEWAY_TOKEN). --force registers again over an existing identity.
runcommand: Runs the gateway in the foreground; the services run this.
statuscommand: Name and id, API address, key fingerprint, encryption key id, platform key, local credentials, data folder.
credentialscommand: set, list or remove credentials stored only on this gateway, by data source code.
rotate-keycommand: Replaces both key pairs over an authenticated connection. Re-enter the credentials sealed in Prynt afterwards.

Commands of prynt-gateway
Field	Type	Description
`register`	command	Registers with a one-time token (or PRYNT_GATEWAY_URL and PRYNT_GATEWAY_TOKEN). --force registers again over an existing identity.
`run`	command	Runs the gateway in the foreground; the services run this.
`status`	command	Name and id, API address, key fingerprint, encryption key id, platform key, local credentials, data folder.
`credentials`	command	set, list or remove credentials stored only on this gateway, by data source code.
`rotate-key`	command	Replaces both key pairs over an authenticated connection. Re-enter the credentials sealed in Prynt afterwards.

0ok: Success (status: registered).
1error: Network failure, refused or expired token, rejection by Prynt.
2usage: Wrong command or options.
3not registered: status, run or rotate-key on a gateway that is not registered.
4already registered: register without --force on a registered gateway.

Exit codes of prynt-gateway
Field	Type	Description
`0`	ok	Success (status: registered).
`1`	error	Network failure, refused or expired token, rejection by Prynt.
`2`	usage	Wrong command or options.
`3`	not registered	status, run or rotate-key on a gateway that is not registered.
`4`	already registered	register without --force on a registered gateway.

Credentials set on the gateway are read from standard input:

Linux · local credentialsShell

# The password is read from standard input, never from the command lineprintf '%s' "$ERP_PASSWORD" | sudo -u prynt-gateway /opt/prynt-gateway/prynt-gateway \  credentials set ERP_MAIN --username prynt_reader --password-stdin --data-dir /var/lib/prynt-gatewaysudo systemctl restart prynt-gateway

Monitor, update, uninstall

Status. The Gateways page shows each gateway as Waiting for registration, Online, Offline or Revoked, with host name, operating system, version, last contact and the connections that use it. A gateway serving production connections that stays offline is recorded in the audit log.
Update. Run the install script again: on a registered gateway it needs no token and keeps the identity. It stops the service, replaces the binary after checking its SHA-256, keeps your configuration and restarts it. With Docker, load the new image and recreate the container on the same volume. There is no automatic update yet.
Revoke. Revoke… in the gateway's menu disconnects it at once and refuses it for good; the confirmation lists the connections that use it. To reinstall, add a new gateway.
Uninstall. install.ps1 -Uninstall (add -RemoveData to delete identity and audit) or install.sh --uninstall (--purge also removes data and user), then revoke the gateway in Prynt.
Logs. On Linux: journalctl -u prynt-gateway -n 50. With Docker: docker logs prynt-gateway.

Troubleshooting

Token refusedregister: The token is unknown, expired (15 minutes) or already used: create a new one from the gateway's menu, or add a new gateway.
Stays offlineservice: Run prynt-gateway status; check outbound access to the API host on port 443, the server's clock and that the gateway was not revoked.
Gateway offlineDesigner, API: Queries, previews and renders fail with GATEWAY_OFFLINE (the API answers 503 DATA_SOURCE_UNAVAILABLE) until the service is back.
GATEWAY_TIMEOUTquery: The gateway is connected but did not answer in time: check the server and its connection to the database.
No credentialsquery: Enter them in the data source connection (sealed for this gateway) or with prynt-gateway credentials set.
Re-enter credentialsdata source: After rotate-key, or when the connection switches to another gateway, the sealed credentials must be entered again.
GATEWAY_LIMIT_EXCEEDEDquery: A limit of prynt-gateway.json was exceeded (rows, bytes, schemas).
Standbylog: Another process with the same identity is connected; this one waits. Register separate gateways for high availability.

Common gateway problems
Field	Type	Description
`Token refused`	register	The token is unknown, expired (15 minutes) or already used: create a new one from the gateway's menu, or add a new gateway.
`Stays offline`	service	Run prynt-gateway status; check outbound access to the API host on port 443, the server's clock and that the gateway was not revoked.
`Gateway offline`	Designer, API	Queries, previews and renders fail with GATEWAY_OFFLINE (the API answers 503 DATA_SOURCE_UNAVAILABLE) until the service is back.
`GATEWAY_TIMEOUT`	query	The gateway is connected but did not answer in time: check the server and its connection to the database.
`No credentials`	query	Enter them in the data source connection (sealed for this gateway) or with prynt-gateway credentials set.
`Re-enter credentials`	data source	After rotate-key, or when the connection switches to another gateway, the sealed credentials must be entered again.
`GATEWAY_LIMIT_EXCEEDED`	query	A limit of prynt-gateway.json was exceeded (rows, bytes, schemas).
`Standby`	log	Another process with the same identity is connected; this one waits. Register separate gateways for high availability.

The database side (users, grants, network errors) is covered in Oracle and PostgreSQL; the security model of Prynt as a whole in Security overview.