> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kinetica.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CREATE CREDENTIAL

<a id="sql-create-credential" />

Creates a new [credential](/content/concepts/credentials), which is a
record that contains authentication information required to connect to a
resource outside the database.  Any user may create a *credential* for their own
use.

```sql title="CREATE CREDENTIAL Syntax" theme={null}
CREATE [OR REPLACE] CREDENTIAL [<schema name>.]<credential name>
TYPE = '<type>',
IDENTITY = '<username>',
SECRET = '<password>'
[WITH OPTIONS ('<option name>' = '<option value>'[,...])]
```

The following can make use of *credentials*:

* [Data sources](/content/sql/ddl/create-data-source#sql-create-data-source)
* [Data sinks](/content/sql/ddl/create-data-sink#sql-create-data-sink)
* [ML container registries](/content/sql/ml#sql-ml-create-cr)

The following services are supported:

* Azure *(Microsoft blob storage)*

* GCS *(Google Cloud Storage)*

* HDFS *(Apache Hadoop Distributed File System)*

* JDBC *(Java Database Connectivity, using a user-supplied driver or one of the*
  *drivers on the [supported list](/content/concepts/jdbc_drivers))*

* Kafka *(streaming feed)*

  * *Apache*
  * *Confluent*

* Remote Repositories

  * *Docker*
  * *Nvidia*
  * *OpenAI*

* S3 *(Amazon S3 Bucket)*

For provider-specific syntax, see [Provider-Specific Syntax](/content/sql/ddl/create-credential#sql-create-credential-syntax).
For provider-specific examples, see [Creating Credentials](/content/snippets/create-credentials).

## Parameters

<AccordionGroup>
  <Accordion title="OR REPLACE" id="or-replace" defaultOpen>
    Any existing *credential* with the same name will be dropped before creating this one
  </Accordion>

  <Accordion title="<schema name>" id="<schema-name>" defaultOpen>
    Name of the *schema* that will contain the created *credential*; if no *schema* is specified, the
    *credential* will be created in the user's [default schema](/content/concepts/schemas#schema-default)
  </Accordion>

  <Accordion title="<credential name>" id="<credential-name>" defaultOpen>
    Name of the *credential* to create; must adhere to the supported
    [naming criteria](/content/sql/naming#sql-naming-criteria)
  </Accordion>

  <Accordion title="TYPE" id="type" defaultOpen>
    The type of *credential* to create. Supported types include:

    <div>
      <table class="table w-full [&_td]:min-w-[150px] [&_th]:text-left [&_td[data-numeric]]:tabular-nums">
        <thead>
          <tr>
            <th>Type</th>
            <th>Description</th>
          </tr>
        </thead>

        <tbody>
          <tr>
            <td><code>aws\_access\_key</code></td>
            <td>Authenticate to *Amazon Web Services (AWS)* via *Access Key*</td>
          </tr>

          <tr>
            <td><code>aws\_iam\_role</code></td>
            <td>Authenticate to *Amazon Web Services (AWS)* via *IAM Role*</td>
          </tr>

          <tr>
            <td><code>azure\_ad</code></td>
            <td>Authenticate to *Microsoft Azure* via *Active Directory*</td>
          </tr>

          <tr>
            <td><code>azure\_oauth</code></td>
            <td>Authenticate to *Microsoft Azure* via *OAuth*</td>
          </tr>

          <tr>
            <td><code>azure\_sas</code></td>
            <td>Authenticate to *Microsoft Azure* via *Shared Access Signature (SAS)* using an account-level access token, not a container-level one</td>
          </tr>

          <tr>
            <td><code>azure\_storage\_key</code></td>
            <td>Authenticate to *Microsoft Azure* via *Storage Key*</td>
          </tr>

          <tr>
            <td><code>confluent</code></td>
            <td>Authenticate to a *Confluent Kafka* cluster or schema registry</td>
          </tr>

          <tr>
            <td><code>docker</code></td>
            <td>Authenticate to a *Docker* repository</td>
          </tr>

          <tr>
            <td><code>gcs\_service\_account\_id</code></td>
            <td>Authenticate to *Google Cloud* via user ID & private key</td>
          </tr>

          <tr>
            <td><code>gcs\_service\_account\_keys</code></td>
            <td>Authenticate to *Google Cloud* via *JSON key*</td>
          </tr>

          <tr>
            <td><code>hdfs</code></td>
            <td>Authenticate to *HDFS*</td>
          </tr>

          <tr>
            <td><code>jdbc</code></td>
            <td>Authenticate via *Java Database Connectivity*</td>
          </tr>

          <tr>
            <td><code>kafka</code></td>
            <td>Authenticate to an *Apache Kafka* cluster or schema registry</td>
          </tr>

          <tr>
            <td><code>nvidia\_api\_key</code></td>
            <td>Authenticate to the *Nvidia AI* API</td>
          </tr>

          <tr>
            <td><code>openai\_api\_key</code></td>
            <td>Authenticate to the *OpenAI* API</td>
          </tr>
        </tbody>
      </table>
    </div>
  </Accordion>

  <Accordion title="IDENTITY" id="identity" defaultOpen>
    Username to use for authenticating with the *credential*.
  </Accordion>

  <Accordion title="SECRET" id="secret" defaultOpen>
    Password to use for authenticating with the *credential*.
  </Accordion>

  <Accordion title="WITH OPTIONS" id="with-options" defaultOpen>
    Optional indicator that a comma-delimited list of option/value assignments will follow.  See
    [Options](/content/sql/ddl/create-credential#sql-credential-opts) for the full list of options.
  </Accordion>
</AccordionGroup>

## Examples

To create a *credential*, `auser_azure_active_dir_creds`, for
connecting to *Microsoft Azure Active Directory*:

```sql CREATE CREDENTIAL (Azure AD) Example theme={null}
CREATE CREDENTIAL auser_azure_active_dir_creds
TYPE = 'azure_ad',
IDENTITY = 'atypicaluser',
SECRET = 'Passw0rd!'
```

To create a *credential*, `kafka_cred`, for connecting to *Apache Kafka* via SSL:

```sql CREATE CREDENTIAL (Kafka SSL) Example theme={null}
CREATE CREDENTIAL kafka_cred
TYPE = 'kafka'
WITH OPTIONS
(
    'security.protocol' = 'SSL',
    'ssl.ca.location' = 'kifs://ssl/ca-bundle.crt',
    'ssl.certificate.location' = 'kifs://ssl/client.pem',
    'ssl.key.location' = 'kifs://ssl/client.key',
    'ssl.key.password' = 'Passw0rd!'
)
```

<a id="sql-credential-opts" />

## Options

The following is a list of possible credential options and their associated
providers.  For valid combinations of credential options per provider and
authentication mechanism, see [Provider-Specific Syntax](/content/sql/ddl/create-credential#sql-create-credential-syntax).

| Option                       | Provider | Description                                                                                                                 |
| ---------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------- |
| `azure_storage_account_name` | Azure    | Azure storage account name *(only used if* `azure_tenant_id` *is specified)*                                                |
| `azure_tenant_id`            | Azure    | Azure Active Directory tenant identifier                                                                                    |
| `gcs_service_account_keys`   | GCS      | Text of the JSON file containing the GCS private key                                                                        |
| `hdfs_kerberos_keytab`       | HDFS     | Location of the Kerberos keytab file in [KiFS](/content/tools/kifs)                                                         |
| `hdfs_use_kerberos`          | HDFS     | Whether to attempt Kerberos authentication to HDFS                                                                          |
| `s3_aws_role_arn`            | S3       | AWS S3 IAM role                                                                                                             |
| `sasl.kerberos.keytab`       | Kafka    | Location of the Kerberos keytab file in [KiFS](/content/tools/kifs)                                                         |
| `sasl.kerberos.principal`    | Kafka    | Kerberos principal ID                                                                                                       |
| `sasl.kerberos.service.name` | Kafka    | Kerberos service name                                                                                                       |
| `sasl.mechanism`             | Kafka    | SASL scheme to use; one of: <br /> <br /> \* `PLAIN` <br /> \* `GSSAPI`                                                     |
| `sasl.password`              | Kafka    | SASL user password                                                                                                          |
| `sasl.username`              | Kafka    | SASL user ID                                                                                                                |
| `security.protocol`          | Kafka    | Security protocol to use for authentication; one of: <br /> <br /> \* `SSL` <br /> \* `SASL_SSL` <br /> \* `SASL_PLAINTEXT` |
| `ssl.ca.location`            | Kafka    | Location of CA certificates file in [KiFS](/content/tools/kifs)                                                             |
| `ssl.certificate.location`   | Kafka    | Location of client certificate in [KiFS](/content/tools/kifs)                                                               |
| `ssl.key.location`           | Kafka    | Location of client key in [KiFS](/content/tools/kifs)                                                                       |
| `ssl.key.password`           | Kafka    | Password to client key or trust store                                                                                       |

<a id="sql-create-credential-syntax" />

## Provider-Specific Syntax

Several authentication schemes across multiple providers are supported.

* [Azure](/content/sql/ddl/create-credential#sql-create-credential-azure)
* [GCS](/content/sql/ddl/create-credential#sql-create-credential-gcs)
* [HDFS](/content/sql/ddl/create-credential#sql-create-credential-hdfs)
* [JDBC](/content/sql/ddl/create-credential#sql-create-credential-jdbc)
* [Kafka (Apache)](/content/sql/ddl/create-credential#sql-create-credential-kafka)
* [Kafka (Confluent)](/content/sql/ddl/create-credential#sql-create-credential-confluent)
* [Remote Repository](/content/sql/ddl/create-credential#sql-create-credential-repo)
* [S3](/content/sql/ddl/create-credential#sql-create-credential-s3)

<a id="sql-create-credential-azure" />

### Azure

Syntax below, examples [here](/content/snippets/create-credentials#snippet-sql-create-credential-azure).

<CodeGroup>
  ```sql Password theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'azure_storage_key',
  IDENTITY = '<azure storage account name>',
  SECRET = '<azure storage account key>'
  ```

  ```sql SAS Token theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'azure_sas',
  IDENTITY = '<azure storage account name>',
  SECRET = '<azure sas token>'
  ```

  ```sql Active Directory theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'azure_ad',
  IDENTITY = '<ad client id>',
  SECRET = '<ad client secret key>'
  WITH OPTIONS
  (
      STORAGE ACCOUNT NAME = '<azure storage account name>',
      TENANT ID = '<azure tenant id>'
  )
  ```
</CodeGroup>

<a id="sql-create-credential-gcs" />

### GCS

Syntax below, examples [here](/content/snippets/create-credentials#snippet-sql-create-credential-gcs).

<CodeGroup>
  ```sql User ID & Key theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'gcs_service_account_id',
  IDENTITY = '<gcs account id>',
  SECRET = '<gcs account private key>'
  ```

  ```sql JSON Key theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'gcs_service_account_keys',
  WITH OPTIONS (GCS_SERVICE_ACCOUNT_KEYS = '<gcs account json key text>')
  ```
</CodeGroup>

<a id="sql-create-credential-hdfs" />

### HDFS

Syntax below, examples [here](/content/snippets/create-credentials#snippet-sql-create-credential-hdfs).

<CodeGroup>
  ```sql Password theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'hdfs',
  IDENTITY = '<hdfs username>',
  SECRET = '<hdfs password>'
  ```

  ```sql Kerberos Keytab theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'hdfs',
  IDENTITY = '<hdfs username>'
  WITH OPTIONS (KERBEROS KEYTAB = 'kifs://<keytab file path>')
  ```

  ```sql Kerberos Token theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'hdfs',
  IDENTITY = '<hdfs username>'
  WITH OPTIONS (USE KERBEROS = 'true')
  ```
</CodeGroup>

<a id="sql-create-credential-jdbc" />

### JDBC

Syntax below, examples [here](/content/snippets/create-credentials#snippet-sql-create-credential-jdbc).

```sql Password theme={null}
CREATE CREDENTIAL [<schema name>.]<credential name>
TYPE = 'jdbc',
IDENTITY = '<username>',
SECRET = '<password>'
```

<a id="sql-create-credential-kafka" />

### Kafka (Apache)

Syntax below, examples [here](/content/snippets/create-credentials#snippet-sql-create-credential-kafka).

<CodeGroup>
  ```sql SSL with CA Cert theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'kafka'
  WITH OPTIONS
  (
      'security.protocol' = 'SSL',
      'ssl.ca.location' = 'kifs://<client ca certificates path>'
  )
  ```

  ```sql SSL with CA Cert/Client Auth theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'kafka'
  WITH OPTIONS
  (
      'security.protocol' = 'SSL',
      'ssl.ca.location' = 'kifs://<client ca certificates path>',
      'ssl.certificate.location' = 'kifs://<client certificate path>'
  )
  ```

  ```sql SSL with Encryption theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'kafka'
  WITH OPTIONS
  (
      'security.protocol' = 'SSL',
      'ssl.ca.location' = 'kifs://<client ca certificates path>',
      'ssl.certificate.location' = 'kifs://<client certificate path>',
      'ssl.key.location' = 'kifs://<client key path>',
      'ssl.key.password' = '<client key password>'
  )
  ```

  ```sql SASL theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'kafka'
  WITH OPTIONS
  (
      'security.protocol' = 'SASL_SSL',
      'sasl.mechanism' = 'PLAIN',
      'sasl.username' = '<sasl username>',
      'sasl.password' = '<sasl password>'
  )
  ```

  ```sql Kerberos theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'kafka'
  WITH OPTIONS
  (
      'security.protocol' = 'SASL_PLAINTEXT',
      'sasl.mechanism' = 'GSSAPI',
      'sasl.kerberos.service.name' = '<kerberos service name>',
      'sasl.kerberos.keytab' = 'kifs://<kerberos keytab file>',
      'sasl.kerberos.principal' = '<kerberos principal>'
  )
  ```

  ```sql Kerberos SSL theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'kafka'
  WITH OPTIONS
  (
      'security.protocol' = 'SASL_SSL',
      'sasl.mechanism' = 'GSSAPI',
      'sasl.kerberos.service.name' = '<kerberos service name>',
      'sasl.kerberos.keytab' = 'kifs://<kerberos keytab file>',
      'sasl.kerberos.principal' = '<kerberos principal>',
      'ssl.ca.location' = 'kifs://<client ca certificates path>',
      'ssl.certificate.location' = 'kifs://<client certificate path>',
      'ssl.key.location' = 'kifs://<client key path>',
      'ssl.key.password' = '<client key password>'
  )
  ```
</CodeGroup>

<a id="sql-create-credential-confluent" />

### Kafka (Confluent)

Syntax below, examples [here](/content/snippets/create-credentials#snippet-sql-create-credential-confluent).

<CodeGroup>
  ```sql SSL with CA Cert theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'confluent'
  WITH OPTIONS
  (
      'security.protocol' = 'SSL',
      'ssl.ca.location' = 'kifs://<client ca certificates path>'
  )
  ```

  ```sql SSL with CA Cert/Client Auth theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'confluent'
  WITH OPTIONS
  (
      'security.protocol' = 'SSL',
      'ssl.ca.location' = 'kifs://<client ca certificates path>',
      'ssl.certificate.location' = 'kifs://<client certificate path>'
  )
  ```

  ```sql SSL with Encryption theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'confluent'
  WITH OPTIONS
  (
      'security.protocol' = 'SSL',
      'ssl.ca.location' = 'kifs://<client ca certificates path>',
      'ssl.certificate.location' = 'kifs://<client certificate path>',
      'ssl.key.location' = 'kifs://<client key path>',
      'ssl.key.password' = '<client key password>'
  )
  ```

  ```sql SASL theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'confluent'
  WITH OPTIONS
  (
      'security.protocol' = 'SASL_SSL',
      'sasl.mechanism' = 'PLAIN',
      'sasl.username' = '<sasl username>',
      'sasl.password' = '<sasl password>'
  )
  ```

  ```sql Kerberos theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'confluent'
  WITH OPTIONS
  (
      'security.protocol' = 'SASL_PLAINTEXT',
      'sasl.mechanism' = 'GSSAPI',
      'sasl.kerberos.service.name' = '<kerberos service name>',
      'sasl.kerberos.keytab' = 'kifs://<kerberos keytab file>',
      'sasl.kerberos.principal' = '<kerberos principal>'
  )
  ```

  ```sql Kerberos SSL theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'confluent'
  WITH OPTIONS
  (
      'security.protocol' = 'SASL_SSL',
      'sasl.mechanism' = 'GSSAPI',
      'sasl.kerberos.service.name' = '<kerberos service name>',
      'sasl.kerberos.keytab' = 'kifs://<kerberos keytab file>',
      'sasl.kerberos.principal' = '<kerberos principal>',
      'ssl.ca.location' = 'kifs://<client ca certificates path>',
      'ssl.certificate.location' = 'kifs://<client certificate path>',
      'ssl.key.location' = 'kifs://<client key path>',
      'ssl.key.password' = '<client key password>'
  )
  ```
</CodeGroup>

<a id="sql-create-credential-repo" />

### Remote Repository

Syntax below, examples [here](/content/snippets/create-credentials#snippet-sql-create-credential-repo).

<CodeGroup>
  ```sql Docker theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'docker',
  IDENTITY = '<username>',
  SECRET = '<password>'
  ```

  ```sql Nvidia API theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'nvidia_api_key',
  SECRET = '<nvidia api key>'
  ```

  ```sql OpenAI API theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'openai_api_key',
  SECRET = '<openai api key>'
  ```
</CodeGroup>

<a id="sql-create-credential-s3" />

### S3

Syntax below, examples [here](/content/snippets/create-credentials#snippet-sql-create-credential-s3).

<CodeGroup>
  ```sql S3 Access Key theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'aws_access_key',
  IDENTITY = '<aws access key id>',
  SECRET = '<aws secret access key>'
  ```

  ```sql IAM Role theme={null}
  CREATE CREDENTIAL [<schema name>.]<credential name>
  TYPE = 'aws_iam_role',
  IDENTITY = '<aws access key id>',
  SECRET = '<aws secret access key>'
  WITH OPTIONS (S3_AWS_ROLE_ARN = '<amazon resource name>')
  ```
</CodeGroup>