Copy the connection string from the Xata dashboard for the exact branch you want and keep the -rw suffix for write access. When a migration or sync tool reports permission errors on writes, check the hostname suffix before debugging credentials. Treat the connection string as branch-specific, not interchangeable.

Context: Web migration guide (Layerbase): documents the gotcha that Xata branch connection strings come in read-write and read-only variants distinguished by the hostname, like [branch-id]-rw.us-east-1.xata.sh. The -rw in the hostname matters; agents that strip or ignore the suffix can end up on a read-only endpoint and watch writes fail.