> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Credentials

> credentials

ReferenceApplies to: Unified engine deployments

`[credentials]`

## Named credentials

### Startup credentials

Defines named startup credentials that catalog and storage connections can refer to.

* **Default:** `{}`
* **Type:** map

> **Example**
>
> If a startup credential is named `warehouse`, an S3 adapter can select it with `credential_reference = "warehouse"`. These entries are separate from saved Credentials resources.

### Named credential

Defines one named credential that connections can select.

* **Default:** Set when used
* **Type:** choice: `Aws`, `Bearer`, `OAuthClient`

> **Example**
>
> A credential named `warehouse` can hold an AWS access-key pair. Storage configured with `credential_reference = "warehouse"` selects that entry.

## AWS credentials

### `<name>.Aws.access_key_id`

Supplies the AWS access key identifier for this named startup credential. Sensitive values are hidden in Settings.

* **Default:** Set when used
* **Type:** string

> **Example**
>
> Pair this identifier with the matching secret access key. Storage settings can select the named credential rather than repeating the keys.

### `<name>.Aws.secret_access_key`

Supplies the secret half of the AWS access-key pair. Sensitive values are hidden in Settings.

* **Default:** Set when used
* **Type:** string

> **Example**
>
> Use the key belonging to the configured access key ID. It is a sensitive value and is hidden in Settings.

### `<name>.Aws.session_token`

Optionally supplies the AWS session token required by temporary credentials. Sensitive values are hidden in Settings.

* **Default:** Unset
* **Type:** string; optional

> **Example**
>
> Temporary credentials from an assumed role need their session token as well as both access keys. Long-lived access keys do not use this field.

### `<name>.Aws.expires_at`

Records when this credential expires.

* **Default:** Unset
* **Type:** object; optional

> **Example**
>
> For a temporary credential, set the associated Unix-millisecond timestamp so consumers know its configured expiry. Omit it when no expiry is supplied.

### `<name>.Aws.expires_at.unix_millis`

Stores a timestamp as milliseconds since 1970-01-01 UTC.

* **Default:** Set when used
* **Type:** integer

> **Example**
>
> `0` means the Unix epoch, not “never expires.” To omit a credential expiry, omit its optional expires\_at object instead.

## Bearer tokens

### `<name>.Bearer.token`

Supplies the bearer token that the named startup credential sends to a service. Sensitive values are hidden in Settings.

* **Default:** Set when used
* **Type:** string

> **Example**
>
> Name this credential and refer to that name from the connection that needs it. The token itself is treated as sensitive.

### `<name>.Bearer.expires_at`

Records when this credential expires.

* **Default:** Unset
* **Type:** object; optional

> **Example**
>
> For a temporary credential, set the associated Unix-millisecond timestamp so consumers know its configured expiry. Omit it when no expiry is supplied.

### `<name>.Bearer.expires_at.unix_millis`

Stores a timestamp as milliseconds since 1970-01-01 UTC.

* **Default:** Set when used
* **Type:** integer

> **Example**
>
> `0` means the Unix epoch, not “never expires.” To omit a credential expiry, omit its optional expires\_at object instead.

## OAuth clients

### `<name>.OAuthClient.client_id`

Supplies the OAuth client identifier used to request an access token.

* **Default:** Set when used
* **Type:** string

> **Example**
>
> Use the application client ID issued by the catalog’s identity provider, together with its matching client secret.

### `<name>.OAuthClient.client_secret`

Supplies the OAuth client secret paired with the client ID. Sensitive values are hidden in Settings.

* **Default:** Set when used
* **Type:** string

> **Example**
>
> Use the secret issued for that application client. It is treated as sensitive and is not the same as the returned short-lived access token.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.