Credentials management¶

Because there is often a need to access secure data sources, DataRobot provides an option to securely store associated credentials for reuse. This capability is particularly useful for automating workflows that require access to secure sources or when combining many tables and sources that would each otherwise require individual authentication. The Credentials management tile is where you can create new stored credentials, edit or remove existing ones, and add or remove associations with data connections.

Application of stored credentials is available whenever you are prompted for them, such as when:

• Creating a data source from the Data connections page or testing connections.
• Using the Data Source option when beginning a project.
• Using a data source or S3 to make batch predictions via the API.
• Using a data connection to create a new dataset in the AI Catalog.
• Taking a snapshot of a dataset in the AI Catalog.
• Creating a project from a dataset in the AI Catalog.
• Using the AI Catalog to select a prediction dataset using Make Predictions.

To access this page, open Account Settings > Credentials management.

Add new credentials¶

From the Credentials management tile, click + Add new credential.

In the Add new credentials dialog box, select a Credential type, manually enter the required credential fields, then click Save and sign in. The credential entry becomes available in the panel on the left.

Click Add associated connection to add a data connection. Then, select the data connection you would like associated to these credentials and click Connect.

Add credentials from a shared secure configuration¶

IT admins can configure OAuth-based authentication parameters for a data connection, and then securely share them with other users without exposing sensitive fields. This allows users to easily connect to their data warehouse without needing to reach out to IT for data connection parameters. When Enable Secure Config Exposure is active for your organization, these credentials can also be used as runtime parameters in custom models, applications, and jobs so that secret values are injected into those runtimes. For more information, see Using credentials from shared secure configs in runtimes.

From the Credentials management tile, click + Add new credential.

In the Add new credentials dialog box, select a Credential type, click the Shared secure configurations tab, then click Save and sign in.

The credential entry becomes available in the panel on the left.

Using credentials from shared secure configs¶

When Enable Secure Config Exposure is enabled for your organization, credentials created from a shared secure configuration can be used as runtime parameters in:

• Custom models: Use the credential as a runtime parameter when defining or deploying a custom model. The credential’s values are injected into the model’s runtime environment (for example, as environment variables in the container).

• Custom applications: Use the credential as a runtime parameter in custom applications so the application can access the injected values at runtime.

• Custom jobs: Use the credential as a runtime parameter in custom jobs so the job code can read the injected values when the job runs.

When Enable Secure Config Exposure is active, shared secure configuration values are injected directly into the runtime parameters of the custom model, application, or job executed in the cluster. When it is disabled, the credential is injected using only the configuration ID, without exposing the underlying secure configuration values. In the enabled case, the actual secret values from the shared secure configuration (such as access keys or tokens) are exposed in the container's runtime so the code can use them. This differs from secure, back-end–only use (such as Data Connections), where secret values are never sent to user-controlled code.

If your organization has Enable Secure Config Exposure active, admins are notified when sharing a secure configuration that the secret shared configuration values are exposed when used in runtimes.

Manage credentials¶

The Credentials management tile provides the ability to create new stored credentials as well as manage existing ones. Unlike other areas in DataRobot where you interact with stored credentials, you can only edit them from this tile.