Credentials

[credentials]

​

Named credentials

​

Startup credentials

Defines named startup credentials that catalog and storage connections can refer to.

• Default: {}
• Type: map

Example If a startup credential is named warehouse, an S3 adapter can select it with credential_reference = "warehouse". These entries are separate from saved Credentials resources.

​

Named credential

Defines one named credential that connections can select.

• Default: Set when used
• Type: choice: Aws, Bearer, OAuthClient

Example A credential named warehouse can hold an AWS access-key pair. Storage configured with credential_reference = "warehouse" selects that entry.

​

AWS credentials

​

<name>.Aws.access_key_id

Supplies the AWS access key identifier for this named startup credential. Sensitive values are hidden in Settings.

• Default: Set when used
• Type: string

Example Pair this identifier with the matching secret access key. Storage settings can select the named credential rather than repeating the keys.

​

<name>.Aws.secret_access_key

Supplies the secret half of the AWS access-key pair. Sensitive values are hidden in Settings.

• Default: Set when used
• Type: string

Example Use the key belonging to the configured access key ID. It is a sensitive value and is hidden in Settings.

​

<name>.Aws.session_token

Optionally supplies the AWS session token required by temporary credentials. Sensitive values are hidden in Settings.

• Default: Unset
• Type: string; optional

Example Temporary credentials from an assumed role need their session token as well as both access keys. Long-lived access keys do not use this field.

​

<name>.Aws.expires_at

Records when this credential expires.

• Default: Unset
• Type: object; optional

Example For a temporary credential, set the associated Unix-millisecond timestamp so consumers know its configured expiry. Omit it when no expiry is supplied.

​

<name>.Aws.expires_at.unix_millis

Stores a timestamp as milliseconds since 1970-01-01 UTC.

• Default: Set when used
• Type: integer

Example 0 means the Unix epoch, not “never expires.” To omit a credential expiry, omit its optional expires_at object instead.

​

Bearer tokens

​

<name>.Bearer.token

Supplies the bearer token that the named startup credential sends to a service. Sensitive values are hidden in Settings.

• Default: Set when used
• Type: string

Example Name this credential and refer to that name from the connection that needs it. The token itself is treated as sensitive.

​

<name>.Bearer.expires_at

Records when this credential expires.

• Default: Unset
• Type: object; optional

Example For a temporary credential, set the associated Unix-millisecond timestamp so consumers know its configured expiry. Omit it when no expiry is supplied.

​

<name>.Bearer.expires_at.unix_millis

Stores a timestamp as milliseconds since 1970-01-01 UTC.

• Default: Set when used
• Type: integer

Example 0 means the Unix epoch, not “never expires.” To omit a credential expiry, omit its optional expires_at object instead.

​

OAuth clients

​

<name>.OAuthClient.client_id

Supplies the OAuth client identifier used to request an access token.

• Default: Set when used
• Type: string

Example Use the application client ID issued by the catalog’s identity provider, together with its matching client secret.

​

<name>.OAuthClient.client_secret

Supplies the OAuth client secret paired with the client ID. Sensitive values are hidden in Settings.

• Default: Set when used
• Type: string

Example Use the secret issued for that application client. It is treated as sensitive and is not the same as the returned short-lived access token.