Credentials
Store external connection secrets, choose project or workspace scope, and rotate dependencies safely.
Credentials store encrypted configuration used by ReportPlane to connect to customer-owned warehouses and compatible services.
They are management resources. Runtime applications never need the underlying warehouse password or service-account key.
Create a credential
Open Security → Credentials → New credential or create one from the warehouse setup flow.
Choose the backend type, enter a descriptive name, provide the exact credential JSON/fields requested by that backend, and choose project-local or workspace-shared scope.
Supported backend families
- BigQuery service-account configuration;
- ClickHouse connection configuration;
- Snowflake account/user/warehouse configuration;
- Elasticsearch compatible authentication;
- OpenSearch compatible authentication.
Scope
Project-local credentials appear only in their project. Workspace-shared credentials can be used by accessible projects in the same workspace and require administrator or owner authorization to create.
Editing and rotation
Before replacing a credential:
- list every destination that references it;
- create and test the replacement identity where possible;
- confirm network and storage permissions;
- update dependent destinations;
- verify delivery and analytics;
- revoke the old external identity.
Least privilege
Grant only the database, dataset, schema, table, index, and query permissions required by selected provisioning settings. Avoid personal accounts and broad administrator roles.
/management/v1/warehouse-credentials/management/v1/warehouse-credentials/{id}