Results of 1 - 10 of about 31 for Token (0.002 sec.)
- Security 13265
- This page covers Quack's security posture end to end: what the server exposes, what stays local, the role of a TLS-terminating reverse proxy, and the authentication / authorization callbacks the server runs on every connection and every que
...is, the extension ships with conservative defaults that prevent accidental exposure: The server requires an authentication token , which the client has to supply on every connection. Unless a token is passed explicitly or supplied by a quack secret, t...he server generates a random token at startup. The server binds to localhost only, non-local hostnames require an explicit allow_other_hostname = true . The...made: Authentication : who is the caller? Establishes identity, usually by having the caller supply a credential (e.g., a token, a password, a client certificate). Authorization : may they do this? Establishes whether an already authenticated caller... - https://man.mtool.work/duckdb/2.0/quack/security.html
- Quack Remote Protocol 11841
- The Quack extension turns a DuckDB instance into a server that other DuckDB instances (clients) can connect to over HTTP. This page covers the protocol at a glance and walks through basic usage on both sides of the wire. For the full list o
...host . quack_serve returns the listen URI, the HTTP URL, and, when the default authentication function is in use, the auth_token that clients need to connect. To choose the token yourself, pass the token parameter (see Security ): {:.codebox-server} C...ALL quack_serve('quack:localhost', token = '⟨my_token⟩'); Tip The DuckDB CLI can start a server directly with the -serve argument and connect to one with -connect...ttaching it. To query a local database via HTTP, run: {:.codebox-client} FROM quack_query( 'quack:localhost', 'SELECT 42', token = '⟨MY_QUACK_TOKEN_01234567890ABCDEF⟩'); Remote databases use HTTPS by default. To override on a plain-HTTP remote, run: {... - https://man.mtool.work/duckdb/2.0/quack/overview.html
- Reference 11162
- This page lists the functions, settings, and log types exposed by the quack extension . For a tour of the protocol, start with the Overview . Function Reference Server Management Function Description quack_serve(⟨listen_uri⟩, ...) Start a s
...to quack:localhost when omitted. Localhost-only by default. Returns the listen URI, the listen URL, and the authentication token. See the quack_serve parameters below. quack_stop(listen_uri) Stop the server listening on listen_uri . quack_server_list(...nal. The Quack URI to listen on. allow_other_hostname BOOLEAN false Allow binding to a non-local hostname, e.g., 0.0.0.0 . token VARCHAR (generated) Authentication token clients have to present (minimum 4 characters). If omitted, the token of the defa...ult quack secret is used if one exists, otherwise a random token is generated. secret VARCHAR (unset) Name of an existing quack secret whose token the server uses. create_secret_if_not_ex... - https://man.mtool.work/duckdb/2.0/quack/reference.html
- Catalogs 10030
- The iceberg extension supports attaching Iceberg REST Catalogs. Attaching a catalog is required for writing to Iceberg . Before attaching an Iceberg REST Catalog, you must install the iceberg extension by following the instructions located
...iceberg, CLIENT_ID '⟨admin⟩', CLIENT_SECRET '⟨password⟩', OAUTH2_SERVER_URI '⟨http://iceberg_rest_catalog_url.com/v1/oauth/tokens⟩' ); If you already have a Bearer token, you can pass it directly to your CREATE SECRET statement CREATE SECRET iceberg_s...ecret ( TYPE iceberg, TOKEN '⟨bearer_token⟩' ); You can attach the Iceberg catalog with the following ATTACH statement. LOAD httpfs; ATTACH '⟨warehous...n, CHAIN sts, ASSUME_ROLE_ARN 'arn:aws:iam::⟨account_id⟩:role/⟨role⟩', REGION 'us-east-2' ); In this example we use an STS token, but other authentication methods are supported . Then, connect to the catalog: ATTACH '⟨account_id⟩' AS glue_catalog ( TY... - https://man.mtool.work/duckdb/2.0/core_extensions/iceberg/catalogs.html
- Hugging Face Support 9399
- The httpfs extension introduces support for the hf:// protocol to access datasets hosted in Hugging Face repositories. See the announcement blog post for details. Usage Hugging Face repositories can be queried using the following URL patter
...ally generates the Parquet files of every dataset to enable efficient scanning. Authentication Configure your Hugging Face Token in the DuckDB Secrets Manager to access private or gated datasets. First, visit Hugging Face Settings – Tokens to obtain y...our access token. Second, set it in your DuckDB session using DuckDB's Secrets Manager . DuckDB supports two providers for managing secrets...to the CREATE SECRET statement . To create a secret using the CONFIG provider, use the following command: CREATE SECRET hf_token ( TYPE huggingface, TOKEN 'your_hf_token' ); credential_chain Automatically tries to fetch credentials. For the Hugging Fa... - https://man.mtool.work/duckdb/2.0/core_extensions/httpfs/hugging_face.html
- AWS Extension 9172
- The aws extension adds functionality, e.g., authentication, on top of the httpfs extension's S3 capabilities , using the AWS SDK. Installing and Loading The aws extension will be transparently autoloaded on first use from the official exten
...oles for Service Accounts (IRSA) — commonly used on Amazon EKS — use the web_identity chain together with a role ARN and a token file. A SESSION_NAME can optionally be set: CREATE OR REPLACE SECRET secret ( TYPE s3, PROVIDER credential_chain, CHAIN 'w...eb_identity', ASSUME_ROLE_ARN 'arn:aws:iam::⟨account_id⟩:role/⟨role⟩', WEB_IDENTITY_TOKEN_FILE '⟨/var/run/secrets/eks.amazonaws.com/serviceaccount/token⟩' ); Single Sign-On (SSO) DuckDB can use credentials obtain...d through AWS IAM Identity Center (formerly AWS SSO). DuckDB does not perform the sign-in itself: it reads the short-lived token that the AWS CLI caches after you sign in. The setup therefore has three steps. First, configure an SSO-enabled profile in... - https://man.mtool.work/duckdb/2.0/core_extensions/aws.html
- Troubleshooting Quack 8962
- DuckDB 2.0 ships a polished version of Quack (first released in DuckDB 1.5.3) with substantial performance and stability improvements. If you experience any issues with Quack, try upgrading all your DuckDB clients to the latest version of t
...catalog_secret, TABLE_RESOLUTION 'eager' ); CREATE TABLE local_data AS SELECT 42 AS i; CALL quack_serve('quack:localhost', token = 'example-token'); The client can then attach and query as usual: {:.codebox-client} -- Client, in a separate DuckDB inst...ance. LOAD quack; ATTACH 'quack:localhost' AS remote (TOKEN 'example-token'); FROM remote.local_data; Eager resolution adds metadata-loading work and can increase catalog enumeration...out importing its catalog: {:.codebox-client} FROM quack_query( 'quack:localhost', 'SELECT count(*) FROM ice.demo.orders', token = 'example-token' );... - https://man.mtool.work/duckdb/2.0/quack/troubleshooting.html
- Deploying Quack 8784
- This page collects deployment recipes for running a public-facing Quack server. Today there is one recipe (AWS EC2), we will introduce more over time. On AWS EC2 The fastest way to get a public-facing Quack server is the one-click AWS Cloud
...stance running DuckDB, the quack extension behind nginx and Let's Encrypt TLS. As its output, it surfaces the per-instance token and connection URI. One-Click Launch Open the Launch Stack URL . Click Create stack in the bottom right. Wait about two mi...uts tab. Click the ConnectURL value to open a shell.duckdb.org session pre-wired to the new instance, or copy QuackURI and Token to connect from a local DuckDB session (see below). The stack defaults to a t3.micro instance; other sizes are selectable...us-west-2 , eu-west-1 , eu-central-1 , ap-northeast-1 , ap-southeast-1 . Connecting from a Local DuckDB Copy QuackURI and Token from the stack's Outputs tab and substitute below: -- Register the credentials once per session. CREATE SECRET quack_crede... - https://man.mtool.work/duckdb/2.0/quack/setup/deployment.html
- Securing Quack with a Reverse Proxy 8654
- By default, the Quack server binds to localhost and speaks plain HTTP. See Security for the rationale behind these configurations. For any deployment beyond local-only, the recommended pattern is the same as for any other HTTP-based databas
...-wide. 2. Start Quack and Connect Through the Proxy In one DuckDB session, start the server (this prints an authentication token): {:.codebox-server} CALL quack_serve('quack:localhost'); In the client session, connect through Caddy on :8443 . Local UR...default to plain HTTP, so you have to force SSL on explicitly: {:.codebox-client} ATTACH 'quack:localhost:8443' AS quack ( TOKEN '⟨authentication_token-from-quack_serve⟩', DISABLE_SSL false ); FROM quack.query('SELECT 42'); If the round-trip succeeds,...en with HTTPS, specify the proxy's port 443 explicitly: {:.codebox-client} ATTACH 'quack:quack.example.com:443' AS quack ( TOKEN '⟨authentication_token-from-quack_serve⟩' ); Caddy + Let's Encrypt Caddy auto-provisions certificates from Let's Encrypt a... - https://man.mtool.work/duckdb/2.0/quack/setup/reverse_proxy.html
- Azure Extension 8363
- The azure extension lets DuckDB read and write files in Azure Blob Storage and Azure Data Lake Storage (ADLS) Gen2. Installing and Loading The azure extension will be transparently autoloaded on first use from the official extension reposit
...Azure SDK via the Azure credential chain. By default, the provider uses the Azure SDK's DefaultAzureCredential chain. The token is fetched at query time, not when the secret is created. For example: CREATE SECRET secret3 ( TYPE azure, PROVIDER creden...⟩', CLIENT_ID '⟨client_id⟩', CLIENT_CERTIFICATE_PATH '⟨client_cert_path⟩', ACCOUNT_NAME '⟨storage_account_name⟩' ); ACCESS_TOKEN Provider The ACCESS_TOKEN provider allows connecting with an OAuth access token (bearer token) that you obtained outside o...f DuckDB: CREATE SECRET azure_token ( TYPE azure, PROVIDER access_token, ACCESS_TOKEN '⟨access_token⟩', ACCOUNT_NAME '⟨storage_account_name⟩' ); Warning The e... - https://man.mtool.work/duckdb/2.0/core_extensions/azure.html
DuckDB 2.0 Documentation / man.mtool.work