> ## Documentation Index
> Fetch the complete documentation index at: https://docs.e6data.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Store a secret and use it

> Keep a bearer token in a named secret. A credential refers to that secret, and

How-to guideApplies to: Unified engine deployments

Keep a bearer token in a named secret. A credential refers to that secret, and
a catalog connection refers to the credential.

## Have a working token ready

Use an existing Iceberg REST catalog that accepts bearer tokens and exposes the
SF1 `item` table in `tpcds_sf1`. Replace its URL, warehouse, namespace, and token
below. This recipe does not obtain or renew the token. The catalog must supply
usable temporary S3 credentials, or you need a
[separate storage credential](https://docs.e6data.com/transformation/recipes/credentials/separate-catalog-storage.md).
The engine needs the local encrypted secret store described in the
[recipe overview](https://docs.e6data.com/transformation/recipes/overview.md#running-the-sql).

## Give the token a stable name

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE SECRET recipe_catalog_token AS '<bearer-token>';
SHOW SECRETS;
DESCRIBE SECRET recipe_catalog_token;

CREATE CREDENTIAL recipe_catalog_auth USING bearer
OPTIONS ('authentication' = 'saved')
SECRETS ('token' = 'recipe_catalog_token');
```

SHOW and DESCRIBE return the name, source, and revision. They do not return the
token. The SECRETS value is the saved secret's name, not the token text.

## Use it in a connection

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
CREATE CATALOG recipe_retail USING `iceberg-rest`
OPTIONS (
  'uri' = 'https://catalog.example.com',
  'warehouse' = 'retail',
  'auth.type' = 'bearer',
  'header.x-iceberg-access-delegation' = 'vended-credentials',
  's3.region' = 'us-east-2',
  's3.endpoint' = 'https://s3.us-east-2.amazonaws.com',
  's3.allow-http' = 'false'
)
CREDENTIALS ('auth' = 'recipe_catalog_auth');

SELECT i_item_sk, i_item_id
FROM recipe_retail.tpcds_sf1.item
ORDER BY i_item_sk
LIMIT 5;
```

The SELECT should return item rows. It checks both catalog access and file
access. Saving the credential alone does not perform either check.

Remove the registration before its credential and secret when finished:

```sql theme={"theme":{"light":"github-light","dark":"github-dark"}}
DROP CATALOG recipe_retail;
DROP CREDENTIAL recipe_catalog_auth;
DROP SECRET recipe_catalog_token;
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.