Store a secret and use it

How-to guideApplies to: Unified engine deployments

Keep a bearer token in a named secret. A credential refers to that secret, and a catalog connection refers to the credential.

Have a working token ready

Use an existing Iceberg REST catalog that accepts bearer tokens and exposes the SF1 item table in tpcds_sf1. Replace its URL, warehouse, namespace, and token below. This recipe does not obtain or renew the token. The catalog must supply usable temporary S3 credentials, or you need a separate storage credential. The engine needs the local encrypted secret store described in the recipe overview.

Give the token a stable name

CREATE SECRET recipe_catalog_token AS '<bearer-token>';
SHOW SECRETS;
DESCRIBE SECRET recipe_catalog_token;

CREATE CREDENTIAL recipe_catalog_auth USING bearer
OPTIONS ('authentication' = 'saved')
SECRETS ('token' = 'recipe_catalog_token');

SHOW and DESCRIBE return the name, source, and revision. They do not return the token. The SECRETS value is the saved secret’s name, not the token text.

Use it in a connection

CREATE CATALOG recipe_retail USING `iceberg-rest`
OPTIONS (
  'uri' = 'https://catalog.example.com',
  'warehouse' = 'retail',
  'auth.type' = 'bearer',
  'header.x-iceberg-access-delegation' = 'vended-credentials',
  's3.region' = 'us-east-2',
  's3.endpoint' = 'https://s3.us-east-2.amazonaws.com',
  's3.allow-http' = 'false'
)
CREDENTIALS ('auth' = 'recipe_catalog_auth');

SELECT i_item_sk, i_item_id
FROM recipe_retail.tpcds_sf1.item
ORDER BY i_item_sk
LIMIT 5;

The SELECT should return item rows. It checks both catalog access and file access. Saving the credential alone does not perform either check. Remove the registration before its credential and secret when finished:

DROP CATALOG recipe_retail;
DROP CREDENTIAL recipe_catalog_auth;
DROP SECRET recipe_catalog_token;

Last modified on November 4, 2026

Transformation Engine

Learn Laminar

Workloads

SQL reference

HTTP API

Recipes

Operations

Store a secret and use it

Have a working token ready

Give the token a stable name

Use it in a connection

​Have a working token ready

​Give the token a stable name

​Use it in a connection

Have a working token ready

Give the token a stable name

Use it in a connection