Use a bearer token

How-to guideApplies to: Unified engine deployments

Send an existing access token to an Iceberg REST catalog. A bearer credential uses token text from a secret reference; it does not perform an OAuth login.

Prepare the token and catalog

Use an existing catalog that accepts your token and exposes an SF1 item table. Replace the URL, warehouse, namespace, and token below. The token must already have the required catalog permissions. The catalog must supply usable temporary S3 credentials, or use a separate storage credential. The local encrypted secret store must be available.

Attach the token by name

CREATE SECRET recipe_bearer_token AS '<access-token>';
CREATE CREDENTIAL recipe_bearer_auth USING bearer
OPTIONS ('authentication' = 'saved')
SECRETS ('token' = 'recipe_bearer_token');

CREATE CATALOG recipe_bearer_retail USING `iceberg-rest`
OPTIONS (
  'uri' = 'https://catalog.example.com',
  'warehouse' = 'retail',
  'auth.type' = 'bearer',
  'header.x-iceberg-access-delegation' = 'vended-credentials',
  's3.region' = 'us-east-2',
  's3.endpoint' = 'https://s3.us-east-2.amazonaws.com',
  's3.allow-http' = 'false'
)
CREDENTIALS ('auth' = 'recipe_bearer_auth');

SELECT i_item_sk, i_item_id
FROM recipe_bearer_retail.tpcds_sf1.item
ORDER BY i_item_sk
LIMIT 5;

Use the raw token, not a JSON object containing it. If the token is already held by a configured external provider, replace the CREATE SECRET statement with a reference such as CREATE SECRET recipe_bearer_token USING 'recipe_ssm:///laminar/recipes/catalog-token' after completing that provider’s setup. Saved bearer tokens are not renewed automatically. Obtain a replacement from the issuer and rotate the secret, or use an OAuth credential when the service supports it. When finished:

DROP CATALOG recipe_bearer_retail;
DROP CREDENTIAL recipe_bearer_auth;
DROP SECRET recipe_bearer_token;

Transformation Engine

Learn Laminar

Workloads

SQL reference

HTTP API

Recipes

Operations

Prepare the token and catalog

Attach the token by name

​Prepare the token and catalog

​Attach the token by name

Prepare the token and catalog

Attach the token by name