> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Use a bearer token

> Send an existing access token to an Iceberg REST catalog. A bearer credential

How-to guideApplies to: Unified engine deployments

Send an existing access token to an Iceberg REST catalog. A bearer credential
uses token text from a secret reference; it does not perform an OAuth login.

## Prepare the token and catalog

Use an existing catalog that accepts your token and exposes an SF1 `item` table.
Replace the URL, warehouse, namespace, and token below. The token must already
have the required catalog permissions. The catalog must supply usable temporary
S3 credentials, or use a [separate storage credential](https://docs.e6data.com/transformation/recipes/credentials/separate-catalog-storage.md).
The local encrypted secret store must be available.

## Attach the token by name

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE SECRET recipe_bearer_token AS '<access-token>';
CREATE CREDENTIAL recipe_bearer_auth USING bearer
OPTIONS ('authentication' = 'saved')
SECRETS ('token' = 'recipe_bearer_token');

CREATE CATALOG recipe_bearer_retail USING `iceberg-rest`
OPTIONS (
  'uri' = 'https://catalog.example.com',
  'warehouse' = 'retail',
  'auth.type' = 'bearer',
  'header.x-iceberg-access-delegation' = 'vended-credentials',
  's3.region' = 'us-east-2',
  's3.endpoint' = 'https://s3.us-east-2.amazonaws.com',
  's3.allow-http' = 'false'
)
CREDENTIALS ('auth' = 'recipe_bearer_auth');
```

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
SELECT i_item_sk, i_item_id
FROM recipe_bearer_retail.tpcds_sf1.item
ORDER BY i_item_sk
LIMIT 5;
```

Use the raw token, not a JSON object containing it. If the token is already held
by a configured external provider, replace the CREATE SECRET statement with a
reference such as `CREATE SECRET recipe_bearer_token USING
'recipe_ssm:///laminar/recipes/catalog-token'` after completing that provider's
[setup](https://docs.e6data.com/transformation/recipes/secrets/aws-parameter-store.md#prepare-the-external-source).

Saved bearer tokens are not renewed automatically. Obtain a replacement from
the issuer and [rotate the secret](https://docs.e6data.com/transformation/recipes/secrets/rotate.md), or use an
[OAuth credential](https://docs.e6data.com/transformation/recipes/credentials/oauth-client-credentials.md) when the service supports it.

When finished:

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP CATALOG recipe_bearer_retail;
DROP CREDENTIAL recipe_bearer_auth;
DROP SECRET recipe_bearer_token;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.