---
title: "Configure client authentication in YSQL"
url: "https://docs.yugabyte.com/stable/secure/enable-authentication/ysql_hba_conf-configuration/"
---

# Configure client authentication in YSQL

Use the ysql_hba_conf_csv flag to configure client authentication in YSQL.

- [YSQL](/stable/secure/enable-authentication/ysql_hba_conf-configuration/)

YugabyteDB client authentication for YSQL is managed by the YB-TServer [--ysql\_hba\_conf\_csv](/stable/reference/configuration/yb-tserver/#ysql-hba-conf-csv "--ysql_hba_conf_csv") configuration flag, which works similarly to the [pg\_hba.conf](https://www.postgresql.org/docs/15/auth-pg-hba-conf.html "pg_hba.conf") file in PostgreSQL.

The values include records that specify allowed connection types, users, client IP addresses, and the authentication method.

Records in the YugabyteDB `ysql_hba.conf` file are auto generated based on the values included in the `--ysql_hba_conf_csv` flag.

For example, starting a YB-TServer with the following `--ysql_hba_conf_csv` flag enables trust authentication for all users:

```sh
--ysql_hba_conf_csv='host all all 0.0.0.0/0 trust, host all all ::0/0 trust'
```

To display the current values in the `ysql_hba.conf` file, run the following `SHOW` statement to get the file location:

```sql
yugabyte=# SHOW hba_file;
```

```output
                     hba_file
-------------------------------------------------------
 /Users/yugabyte/yugabyte-data/node-1/disk-1/pg_data/ysql_hba.conf
(1 row)
```

and then view the file. Here is an example of `ysql_hba.conf` file contents.

```output
# This is an autogenerated file, do not edit manually!
host all all 0.0.0.0/0 trust
host all all ::0/0 trust
```

For more information, refer to [Host-based authentication](/stable/secure/authentication/host-based-authentication "Host-based authentication").