datlechin · Oct 20, 2026 · Oct 20, 2026
diff --git a/connections/aws-iam.mdx b/connections/aws-iam.mdx
@@ -105,6 +105,10 @@ mydb.abc123.us-east-1.rds.amazonaws.com:5432
 
 The port is optional, falling back to 5432 for PostgreSQL and 3306 for MySQL and MariaDB. The field also covers a CNAME or any alias AWS did not issue, and is honored only when **Host** is loopback or already the same hostname.
 
+## On iPhone and iPad
+
+Synced connections keep their AWS IAM option. **AWS IAM (Profile)** needs an access key saved on the device, and **AWS IAM (SSO)** signs in to IAM Identity Center from the device itself. [IAM sign-in](/ios#iam-sign-in) covers the setup.
+
 ## Troubleshooting
 
 ### Could not determine an AWS region for "…"

diff --git a/connections/cloud-sql-proxy.mdx b/connections/cloud-sql-proxy.mdx
@@ -93,6 +93,8 @@ gcloud sql users create name@example.com --instance=INSTANCE --type=cloud_iam_us
 
 These options also work with **Connect via > Cloud SQL Auth Proxy**. SSL then stays as set, because the proxy encrypts the connection to the instance.
 
+A connection synced to an iPhone or iPad keeps its method, and **Application Default** there needs a service account key for that device: see [IAM sign-in](/ios#iam-sign-in).
+
 ## Troubleshooting
 
 ### cloud-sql-proxy was not found

diff --git a/development/plugin-development.mdx b/development/plugin-development.mdx
@@ -13,7 +13,7 @@ A plugin is a macOS loadable bundle target with `WRAPPER_EXTENSION = tableplugin
 
 | Key | Type | Required | Purpose |
 |-----|------|----------|---------|
-| `TableProPluginKitVersion` | integer | Yes | The PluginKit ABI the plugin was built against. Current value: 39 |
+| `TableProPluginKitVersion` | integer | Yes | The PluginKit ABI the plugin was built against. Current value: 40 |
 | `TableProProvidesDatabaseTypeIds` | array of strings | Recommended | Database type IDs the plugin serves, which is what makes lazy loading possible |
 | `CFBundleShortVersionString` | string | Yes | Plugin version shown in **Settings > Plugins** |
 | `CFBundleVersion` | string | Yes | Build number. Of two copies of a plugin the higher build loads, and a registry update needs a higher build |

diff --git a/images/ios-iam-sign-in-dark.png b/images/ios-iam-sign-in-dark.png
diff --git a/images/ios-iam-sign-in.png b/images/ios-iam-sign-in.png
diff --git a/ios/index.mdx b/ios/index.mdx
@@ -97,6 +97,31 @@ Picking a SQLite file copies it into the app, and edits go to that copy, so the
 
 A database created with **Create New Database**, or copied in by picking it, stays with its connection through an app update and a restore from backup. A file that is gone is reported as unavailable, and so is a file connection synced from another iPhone or iPad; the connection never opens an empty database, or a file of the same name on this device, in its place.
 
+## IAM sign-in
+
+Short-lived tokens replace the password for [AWS IAM](/connections/aws-iam) on Amazon RDS and Aurora (MySQL, MariaDB, PostgreSQL) and ElastiCache (Redis), and for [Google Cloud IAM](/connections/cloud-sql-proxy#iam-sign-in-without-the-proxy) on Cloud SQL (MySQL, PostgreSQL). Pick the method under **Authentication** in the connection's form, and the **Password** field goes away. Each connect signs a fresh token and never saves it.
+
+The methods match the Mac's, but two of them read files that only the Mac has:
+
+| Method | What this device needs |
+| --- | --- |
+| **AWS IAM (Access Key)** | The access key in the form. With **Sync Passwords** on, a key saved on the Mac comes over |
+| **AWS IAM (Profile)** | A key under **Access Key for This Device**, since the profile is read from files on the Mac |
+| **AWS IAM (SSO)** | **Start URL** and **SSO Region** under **IAM Identity Center**, then **Sign In with IAM Identity Center** and an **Account** and **Role** |
+| **Google Cloud IAM (Service Account)** | The JSON key: tap **Service Account Key** to paste it or choose the file. A key pasted on the Mac comes over with **Sync Passwords**; a key file on the Mac does not |
+| **Google Cloud IAM (Application Default)** | A service account key under **Key for This Device**, since the `gcloud` credentials are files on the Mac |
+
+A key for this device and the IAM Identity Center settings stay on this device. They never sync, whatever **Sync Passwords** says, and the connection on the Mac does not change. Opening a connection that still needs one says which, with **Edit Connection** to add it.
+
+<Frame caption="A Profile connection signs in once this device has its own access key">
+  <img className="block dark:hidden" src="/images/ios-iam-sign-in.png" alt="AWS Profile Is on the Mac error with Edit Connection and Retry, beside the connection form's Authentication section set to AWS IAM (Profile) with an empty Access Key for This Device section" />
+  <img className="hidden dark:block" src="/images/ios-iam-sign-in-dark.png" alt="AWS Profile Is on the Mac error with Edit Connection and Retry, beside the connection form's Authentication section set to AWS IAM (Profile) with an empty Access Key for This Device section" />
+</Frame>
+
+**Sign In with IAM Identity Center** shows a code and opens the browser; confirm the code there. When that sign-in expires, opening the connection offers to sign in again.
+
+A token needs an encrypted connection. A MySQL, MariaDB or PostgreSQL connection with **SSL Mode** on **Disabled** connects with **Required**, and a MySQL server that offers no TLS is refused before the token is sent. A Redis connection with SSL off fails until you turn SSL on.
+
 ## What works
 
 An open connection fills the screen and carries four sections: **Tables**, **Query**, **History**, **Info**. They sit in a tab bar on iPhone and in a sidebar on iPad.