Welcome back.
Log in to your LakehouseBox account.
New here? Create your account first; Continue with Google works there too.
or
Advanced connection options
Need help? Contact support
Welcome
Set your password.
You are finishing the setup of your LakehouseBox account.
The link in the mail is valid for three days and works once. Expired? Sign up again with the same address, or ask for a reset link.
Password reset
Choose a new password.
Every session of yours is signed out when it is set. Tokens your agents hold are not affected.
The link is valid for 30 minutes and works once. Expired? Ask for another.
First-run setup
Set up this install.
You become its install administrator: you create the organisations and their admins. The link works once.
Forgot your password
Reset it by email.
Enter the address of your account. If it has one, a link to choose a new password is on its way; it is valid for 30 minutes.
Check your email.
If has a LakehouseBox account, a mail from no-reply@lakehousebox.com with the reset link is on its way. The link is valid for 30 minutes and works once.
Nothing arrives within a minute? Check the spam folder, then the spelling of the address; a new link can be requested once a minute. An account that logs in through an external identity provider has no password here and gets no mail.
Sign in from the command line
Let lhbox act as you?
It can do what you can do here, in every organisation you belong to, until its key ends (30 days unless your administrator set otherwise). Revoke it any time under Settings › Access keys.
Sign in from the command line
Connect this agent to your catalog?
Its key goes to that machine only. Disconnect it any time under Settings › Access keys.
First login
Name your organisation.
You are signed in, but this identity belongs to no organisation yet. Catalogs, tokens and members live in one; you will be its first admin.
Back office
Platform admin
Sign-ups per day
Storage by organisation
Storage and capacity
Top catalogs, local disk
Top catalogs, cold tier
Sign-ups by campaign
Host
People
Every account with an address, newest first. Addresses are personal data: they are shown here to platform admins and nowhere else.
New organisation
Its first admin: a person with an account becomes its admin at once; any other address gets an admin invitation (its link is shown here once, and mailed when the install has mail).
Approved OAuth / MCP clients
Clients registered here connect through the consent page even with dynamic registration off (AL_OAUTH_ALLOW_DCR=false). A client identified by an https metadata URL needs no registration.
Home
Catalogs
Browse your data, feeds and agents by catalog.
AGENTS.md
Shared context for people and agents using this catalog.
Provided to agents as catalog context. Stored as AGENTS.md.
Tables 0
Files 0
What lives here
Plain files next to the tables: photos, documents, exports. Upload them here (or drop them on this page), or let uploaders, feeds and your agent send them. Listed from as this catalog's own identity; previews and downloads come straight from the store.
Feeds 0
A feed keeps a table filled on its own. It works one of two ways: something sends data in (a script, a program, a device such as a weather station), or a scheduled query fetches it from a URL on a timer. A query that fetches from a source needing an API key uses a connection below.
How feeds work
Receives data: a program or script sends rows as JSON with the feed's send key; a device (a weather station, say) posts its usual form to the feed's device address. The feed turns what arrives into the table's columns and writes it to the table every few minutes (5 by default). Fetches on a schedule: a SQL query reads one or more URLs at the times you set and writes the result to the table; make one, preview it and edit it here with New SQL sink below. Either kind can be made by your agent or with the CLI (lhbox sink create). Feeds and devices. Scheduled SQL.
Connections 0 API keys for scheduled queries
The key a scheduled query sends to a source that asks for one, only to URLs under the prefix you set. Stored here and never shown again; the query names only the URL. Paste one below, or let your agent store it (lhbox sink connection create). Scheduled SQL.
Agents 0
Hosted agents that read this catalog. An agent belongs to the organisation and can read several catalogs; it is made and changed on the Agents page.
Permissions
Manage who can read or write this catalog.
Organisation members can read this catalog. Admins and the creator can also write.
Permissions apply to only. Removing someone's access here also rotates this catalog's key pair if they were handed it: recipes pasted into engines then need a fresh one.
Catalog settings
Visibility, defaults and the details engines and the API use.
Visibility
Control who can read the files in this catalog.
Making it public lets anyone, without an account, query its tables and read and list their files. Nobody outside your organisation can write or delete.
Only organisation admins can change visibility; the name typed out confirms it.
Catalog credential
Issue a new key pair and revoke the old one at once.
Every engine using the old recipe stops; fetch a new recipe afterwards. Storage sessions already vended keep working until they expire, up to one hour. Admins only.
Details
Where this catalog lives and the identifiers behind its name, for a recipe or a request written by hand.
Details
Where this catalog lives and the identifiers behind its name, for a recipe or a request written by hand.
Copy to your own bucket
Your tables as standard Iceberg, in storage you own.
Copy this catalog into a bucket you own (Amazon S3, Google Cloud Storage or any S3-compatible store) as standard Iceberg tables, readable by any Iceberg engine without LakehouseBox.
Interested in continuous replication? Contact us for Enterprise support.
Danger zone
SQL explorer
Query the catalogs you switch on in the explorer; one query can join across them.
Nothing attached yet.
Runs in this browser tab, read-only. Pick a table in the explorer for its schema. Connection details
This panel refuses statements other than SELECT, WITH, SHOW, DESCRIBE, EXPLAIN as a courtesy against accidents; it is not a permission. The credential is the boundary: each catalog you switch on is attached with its read-only credential (the catalog refuses commits made with it), so nothing typed here can change a table. When a catalog's endpoint does not answer from this browser, the page attaches it table by table instead, with a credential scoped to one table's prefix, and says so. A colleague's catalog is attached from the read-only recipe they send you (lhbox connect --catalog <name> --readonly); its key lives in this tab only. Writes go through your engine (DuckDB, PyIceberg, Spark) with the connection recipe. A query without a LIMIT gets one.
Query
DuckDB SQLResults
Agents
Agents that run on your data and put it to work.
Connecting Claude Code, Cursor or another client?
Allowance
The model tokens and runs this organisation's plan includes for hosted agents.
Integrations
Services your agents may use through MCP, with your consent. LakehouseBox keeps the credentials; an agent only gets what its definition names.
The machines and applications that reach this organisation's catalogs, and their keys.
To connect an agent, run lhbox login in it and approve the code here: it gets its own key for the catalogs you choose. A key made here is for a job or a script that cannot approve a login. How access works
The people of this organisation and their roles.
Members
Admins manage everything; members read every catalog.
About the two roles
Two roles: admin (everything, including inviting, removing and deleting catalogs) and member (read on every catalog, write on the ones they create or are granted). The last admin cannot leave or be demoted.
Invite
Invite a colleague into this organisation.
Organisation
Its name, its address and who may join.
Domains
Claim your email domain, publish the DNS TXT record it gives you and verify it. A claim does nothing until it is verified. Once verified and switched on below, colleagues with an address there are offered membership and join only if they accept; nobody is added automatically, and someone who left or was removed is not offered it again. Public mail domains cannot be claimed.
Member permissions
What members may do. Admins always may, unless a setting says nobody.
Activity catalog
Your organisation's activity log as a catalog only LakehouseBox writes. Ask your agent about it, or query it with SQL.
Single sign-on
Your organisation's own identity provider signs your people in.
SCIM provisioning
Your directory creates, updates and removes your people and groups.
Group rules
A directory group gives its members the admin role or access to a catalog, a namespace or a table.
Service accounts
Applications of your directory that your pipelines and scheduled jobs sign in as.
Account
You: your profile, how you sign in, your sessions.
You
Who is signed in, and how.
Danger zone
Delete account
Remove your account and revoke your keys.
What deleting does
Deletes your account now: every API key of yours revoked, your identity unlinked, your memberships removed. An organisation you are the only member of is deleted with you; its catalogs are unreachable at once, kept for 7 days, then purged. Catalogs you made in an organisation that keeps members stay with it. If you are the only admin of an organisation with other members, make someone else an admin first. It asks for your password, and for a code when two-factor authentication is on. This cannot be undone.
Change password
At least 12 characters. Your other sessions sign out; this one stays.
Passkeys
Sign in with your device's fingerprint, face or PIN instead of the password. A passkey only works on lakehousebox.com, so a look-alike site cannot use it. It counts as two-factor on its own; your password keeps working as before.
Two-factor authentication
A code from an authenticator app when you log in with your password.
What it covers
A code from an authenticator app on your phone (Google Authenticator, 1Password, Aegis, Authy…) at every login with your password, on top of it. A Google account you have connected signs in on Google's own protection, without the code (if two-factor is on when you connect it, the code is asked that once). A passkey counts as both factors. API keys and access tokens are not affected; approving an agent's lhbox login happens in this browser session, so it is covered.
- Scan this QR code with the authenticator app, or type the key under it.
- Type the 6-digit code the app then shows.
Key:
Sessions
Browser tabs signed in as you.
How revoking works
Every browser tab logged in as you. Revoking one signs it out at its next request; the refresh token behind it stops working at once.