> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect to Apache Polaris using OAuth and separate S3 credentials

> Register Apache Polaris in Unified and read an existing table with OAuth and

How-to guideApplies to: Unified engine deployments

Register Apache Polaris in Unified and read an existing table with OAuth and
separate S3 credentials.

## Before you start

Use an existing catalog with at least one readable Iceberg table. The engine and
workers must reach the catalog and its table storage. Have the remote identity
and permissions ready before creating the Unified registration. Replace the
namespace and table with one you know has data.

Use the catalog API URI and warehouse name provided by your Polaris
administrator. For OAuth, collect its token endpoint and the scope granted to
the client.

The AWS runtime identity must have S3 list/read access to the actual table
prefixes and any required KMS decrypt permission. This explicit storage
credential takes priority over catalog-provided storage credentials. Local
secret values require the
[encrypted secret store](https://docs.e6data.com/transformation/operations/configuration/secrets.md).

## Values to collect

* Catalog API URI, warehouse, namespace, and table.
* Client ID, client secret, token endpoint, and granted scope.
* S3 region and HTTPS endpoint; an AWS runtime identity that can read the table
  files.

## Run the SQL

Replace every `<placeholder>` before running. Use unused names for the resources
below. Run the statements in order in Workbench.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE SECRET recipe_polaris_separate_storage_secret AS '<client-secret>';

CREATE CREDENTIAL recipe_polaris_separate_storage_auth USING oauth2
OPTIONS (
  'authentication' = 'client_credentials',
  'client_id' = '<client-id>',
  'token_endpoint' = '<token-endpoint>'
)
SECRETS ('client_secret' = 'recipe_polaris_separate_storage_secret');

CREATE CREDENTIAL recipe_polaris_separate_storage_storage USING aws
OPTIONS (
  'authentication' = 'default_chain',
  'region' = '<aws-region>'
);

CREATE CATALOG recipe_polaris_separate_storage USING `iceberg-rest`
OPTIONS (
  'uri' = '<catalog-api-uri>',
  'warehouse' = '<warehouse>',
  'catalog.type' = 'polaris',
  'auth.type' = 'oauth2',
  'oauth2-server-uri' = '<token-endpoint>',
  'scope' = '<granted-scope>',
  's3.region' = '<aws-region>',
  's3.endpoint' = '<s3-endpoint>',
  's3.allow-http' = 'false'
)
CREDENTIALS ('auth' = 'recipe_polaris_separate_storage_auth', 'storage' = 'recipe_polaris_separate_storage_storage');

SELECT *
FROM recipe_polaris_separate_storage.`<namespace>`.`<table>`
LIMIT 5;
```

## Check the result

The SELECT should return up to five rows from the chosen table. Use a nonempty
table for this check. This verifies both metadata and table-file access;
creating the registration alone does not verify either.

## Clean up

This removes only the Unified registrations. It leaves the remote catalog and
its tables in place.

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP CATALOG recipe_polaris_separate_storage;
DROP CREDENTIAL recipe_polaris_separate_storage_storage;
DROP CREDENTIAL recipe_polaris_separate_storage_auth;
DROP SECRET recipe_polaris_separate_storage_secret;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.