Credential Formats Reference

Credential Formats Reference

This page shows the exact credential format Spartera expects for every supported platform. The Seller Dashboard displays these samples inline when you create a connection — this page is the full reference.

Security: Always use dedicated read-only credentials. Never use admin accounts or personal credentials. See Connection Permissions for minimum required permissions per platform.

Google Cloud Platform

BigQuery (Engine ID: `1`)

Credential type: SERVICE_ACCOUNT

{
  "type": "service_account",
  "project_id": "your-gcp-project-id",
  "private_key_id": "abcd1234efgh5678ijkl9012mnop3456qrst7890",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC...\n-----END PRIVATE KEY-----\n",
  "client_email": "[email protected]",
  "client_id": "123456789012345678901",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token",
  "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
  "client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/bigquery-service%40your-project.iam.gserviceaccount.com"
}

Download this JSON key from: GCP Console → IAM & Admin → Service Accounts → [your account] → Keys → Add Key → JSON

Cloud SQL — MySQL (Engine ID: `3`)

Credential type: SERVICE_ACCOUNT or JSON

Service Account:

{
  "type": "service_account",
  "project_id": "your-gcp-project-id",
  "private_key_id": "key-id-here",
  "private_key": "-----BEGIN PRIVATE KEY-----\nYOUR_PRIVATE_KEY\n-----END PRIVATE KEY-----\n",
  "client_email": "[email protected]",
  "client_id": "123456789012345678901",
  "auth_uri": "https://accounts.google.com/o/oauth2/auth",
  "token_uri": "https://oauth2.googleapis.com/token"
}

JSON (direct connection):

{
  "instance_connection_name": "project:region:instance",
  "database": "your-database",
  "username": "your-username",
  "password": "your-password"
}

Cloud SQL — PostgreSQL (Engine ID: `28`)

Credential type: SERVICE_ACCOUNT or JSON

{
  "instance_connection_name": "project:region:instance",
  "database": "postgres",
  "username": "postgres",
  "password": "your-password"
}

Amazon Web Services

Redshift (Engine ID: `4`)

Credential type: ACCESS_KEY or JSON

Access Key:

{
  "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
  "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
  "region": "us-west-2"
}

JSON (direct):

{
  "host": "your-cluster.redshift.amazonaws.com",
  "port": 5439,
  "database": "your-database",
  "username": "your-username",
  "password": "your-password"
}

RDS MySQL (Engine ID: `5`)

Credential type: ACCESS_KEY or JSON

{
  "host": "your-instance.rds.amazonaws.com",
  "port": 3306,
  "database": "your-database",
  "username": "your-username",
  "password": "your-password"
}

Redshift Serverless (Engine ID: `9`)

Credential type: ACCESS_KEY or JSON

Access Key:

{
  "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
  "SecretAccessKey": "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
  "region": "us-west-2",
  "workgroup": "your-workgroup"
}

JSON:

{
  "host": "your-workgroup.account-id.region.redshift-serverless.amazonaws.com",
  "port": 5439,
  "database": "dev",
  "username": "admin",
  "password": "your-password"
}

Aurora Serverless (Engine ID: `25`)

Credential type: ACCESS_KEY or JSON

{
  "host": "your-cluster.cluster-xxxxxx.us-east-1.rds.amazonaws.com",
  "port": 3306,
  "database": "your-database",
  "username": "admin",
  "password": "your-password"
}

Aurora Provisioned — MySQL (Engine ID: `26`)

Credential type: ACCESS_KEY or JSON

{
  "host": "your-cluster.cluster-xxxxxx.us-east-1.rds.amazonaws.com",
  "port": 3306,
  "database": "mysql",
  "username": "admin",
  "password": "your-password"
}

Aurora Provisioned — PostgreSQL (Engine ID: `27`)

Credential type: ACCESS_KEY or JSON

{
  "host": "your-cluster.cluster-xxxxxx.us-east-1.rds.amazonaws.com",
  "port": 5432,
  "database": "postgres",
  "username": "postgres",
  "password": "your-password"
}

Microsoft Azure

SQL Server (Engine ID: `16`)

Credential type: CLIENT_SECRET or JSON

JSON:

{
  "server": "192.168.1.100",
  "database": "MyDatabase",
  "authentication": {
    "username": "myuser",
    "password": "mypassword"
  }
}

Azure SQL (Client Secret):

{
  "tenantId": "12345678-1234-1234-1234-123456789012",
  "clientId": "87654321-4321-4321-4321-210987654321",
  "clientSecret": "your-azure-client-secret-here",
  "subscriptionId": "11111111-2222-3333-4444-555555555555",
  "resourceGroupName": "your-resource-group",
  "serverName": "your-sql-server.database.windows.net",
  "databaseName": "your-database-name"
}

Multi-Cloud & Database Platforms

Snowflake (Engine ID: `15`)

Credential type: JSON or KEY_PAIR

`JSON` (username + password)

{
  "account": "abc12345.us-west-2.aws",
  "user": "ANALYTICS_USER",
  "password": "your-snowflake-password",
  "role": "ANALYST_ROLE",
  "warehouse": "COMPUTE_WH",
  "database": "ANALYTICS_DB",
  "schema": "PUBLIC"
}

`KEY_PAIR` (RSA key-pair)

Snowflake's key-pair authentication skips passwords entirely. You register the public key on your Snowflake user; you upload the matching private key to Spartera (stored encrypted in GCP Secret Manager).

Unencrypted private key:

{
  "account": "abc12345.us-west-2.aws",
  "user": "ANALYTICS_USER",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC...\n-----END PRIVATE KEY-----\n",
  "role": "ANALYST_ROLE",
  "warehouse": "COMPUTE_WH",
  "database": "ANALYTICS_DB",
  "schema": "PUBLIC"
}

Encrypted private key (include the passphrase):

{
  "account": "abc12345.us-west-2.aws",
  "user": "ANALYTICS_USER",
  "private_key": "-----BEGIN ENCRYPTED PRIVATE KEY-----\nMIIFHDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQI...\n-----END ENCRYPTED PRIVATE KEY-----\n",
  "private_key_passphrase": "your-passphrase",
  "role": "ANALYST_ROLE",
  "warehouse": "COMPUTE_WH",
  "database": "ANALYTICS_DB",
  "schema": "PUBLIC"
}

Generate a key pair:

# Unencrypted (simplest)
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -nocrypt -out rsa_key.p8
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

# Encrypted (prompts for passphrase)
openssl genrsa 2048 | openssl pkcs8 -topk8 -inform PEM -out rsa_key.p8
openssl rsa -in rsa_key.p8 -pubout -out rsa_key.pub

Register the public key on your Snowflake service user:

ALTER USER ANALYTICS_USER SET RSA_PUBLIC_KEY='MIIBIjANBgkqh...';
-- Paste the contents of rsa_key.pub, excluding the BEGIN/END header lines

Verify it took effect:

DESC USER ANALYTICS_USER;
-- Look for RSA_PUBLIC_KEY_FP in the result

Upload the PRIVATE key to Spartera, never the public key. The private key starts with -----BEGIN PRIVATE KEY----- or -----BEGIN ENCRYPTED PRIVATE KEY-----. The public key (rsa_key.pub) stays in Snowflake — it's what Snowflake uses to verify signatures from our side.

When embedding a PEM key in JSON, every newline inside the key must be escaped as \n (same rule as the GCP service account private_key field above).
Security: Use a dedicated service user with a custom role scoped only to the databases, schemas, and warehouse Spartera needs — not ACCOUNTADMIN or SYSADMIN. See Connection Permissions for the exact grants.

Teradata Vantage (Engine ID: `17`)

Credential type: JSON or USERNAME_PASSWORD

{
  "host": "your-teradata-host.teradata.com",
  "user": "your-username",
  "password": "your-password",
  "database": "your-database",
  "port": 1025,
  "logLevel": 0
}

Supabase — PostgreSQL (Engine ID: `23`)

Credential type: JSON or USERNAME_PASSWORD

{
  "host": "db.xxxxxxxxxxxxxxxxxxxx.supabase.co",
  "database": "postgres",
  "port": 5432,
  "username": "postgres",
  "password": "your-database-password"
}

Supabase — Analytics (Engine ID: `24`)

Credential type: JSON or API_KEY

JSON:

{
  "project_ref": "xxxxxxxxxxxxxxxxxxxx",
  "service_role_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "anon_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
}

API Key:

{
  "api_key": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
  "project_url": "https://xxxxxxxxxxxxxxxxxxxx.supabase.co"
}

Databricks SQL (Engine ID: `29`)

Credential type: JSON

{
  "server_hostname": "adb-1234567890123456.7.azuredatabricks.net",
  "http_path": "/sql/1.0/warehouses/abcd1234efgh5678",
  "access_token": "dapi1234567890abcdef1234567890abcdef",
  "catalog": "main",
  "schema": "default"
}

catalog and schema are optional. Omit catalog to use hive_metastore; omit schema to use the default schema.

Security: The access token inherits all permissions of the generating user. Always create a dedicated service principal with minimum permissions. See Connection Permissions.

Databricks Model Serving (Engine ID: `30`)

Credential type: API_KEY

{
  "workspace_url": "https://adb-1234567890123456.7.azuredatabricks.net",
  "serving_endpoint": "my-model-endpoint",
  "access_token": "dapi1234567890abcdef1234567890abcdef"
}

External & Data APIs

External / Data API (Engine ID: `20`)

Credential type: API_KEY (with api_key_location of HEADER, URL, or BEARER)

External API connections serve two purposes, set by the API Type (request_format) field: Managed Calculation (STRUCTURED, sold as a Calculation asset) or Data Feed Passthrough (PASSTHROUGH, sold as a Data endpoint). See External API Connections for the full guide.

The credential is the API key itself. Where it's sent depends on api_key_location:

BEARER — sent as Authorization: Bearer <key>. Store the bare key; Spartera adds the Bearer prefix. api_key_param is not used. This is the format most commercial data APIs expect.
HEADER — sent as a custom header you name in api_key_param (e.g. X-API-Key).
URL — appended as a query parameter (least secure).

{
  "api_key": "your-api-key-here"
}

Related Pages

Connection Permissions Reference — Exact IAM roles and database grants per platform
Creating Data Connections — Step-by-step connection setup guide
Supported Data Sources — Platform overview and requirements