Control / params · All operations

Set up credentials and connections

A variant of Set parameters

Store secrets, obtain tokens and define connections that later steps use to reach a service.

Status

In arcform

Not built yet

arcform does not do this yet; it would live in how a Protocol runs. Its place on the roadmap

What other tools call it

Meridian's classification; an independent blind rating agreed on 95.7% of 324 rows (variant, version 3).

Alteryx Designer (1)
  • LLM Overrideread 2026-09-27

    Choose and configure the LLM provider connection the workflow's AI tools use

Apache Hop (1)
  • Set password encoderread 2026-09-27

    Switch the process-wide two-way password encoder from inside a workflow

Apache NiFi (3)
DuckDB (4)
  • CREATE SECRETread 2026-09-27

    Store credentials for a remote service, scoped to a path

  • duckdb_secret_typesread 2026-09-27

    duckdb_secret_types table function

  • duckdb_secretsread 2026-09-27

    duckdb_secrets table function

  • which_secretread 2026-09-27

    which_secret table function

KNIME Analytics Platform (10)
OpenRefine (2)
Polars (1)
Power Query M (1)
RapidMiner Studio (4)
  • Clear Cookiesread 2026-09-27

    Clear the cookies held for HTTP connections

  • Get JWT (AI Hub)read 2026-09-27

    Obtain a JSON Web Token from an AI Hub server for authenticated calls

  • Get Token (IoT)read 2026-09-27

    Obtain a bearer token for connecting to Altair IoT Studio

  • Read Dictionaryread 2026-09-27

    Read the key-value pairs of a Dictionary connection (such as API keys) into a one-row table

Talend (12)

Background

In DuckDB, a secret is typed, and its type identifies the service it is for, such as AWS S3, Google Cloud Storage or PostgreSQL.[1] KNIME's OAuth2 Authenticator node obtains an access token through an interactive login in a browser window.[2]

When to use it

The use of a hard-coded password greatly increases the possibility of password guessing.[3] Keep credentials in a step of their own, defined once, so the queries that use them carry no keys and can be shared or committed safely. (Meridian's view)

In DuckDB, the CREATE SECRET statement creates a new secret, and in the command line client those statements are stored in its history as plain text.[4] Secrets that DuckDB persists between sessions are stored unencrypted in the ~/.duckdb/stored_secrets directory, protected by file system permissions.[1] Prefer a method that fetches credentials from where they already live over typing them into a statement. (Meridian's view) In KNIME, the OAuth2 Authenticator node's access token is deleted whenever the user closes the workflow, and opening it again needs a fresh interactive login.[2] KNIME's OAuth2 Authenticator node can currently be used only in KNIME Analytics Platform, and does not support execution on KNIME Hub or KNIME Server.[2] An interactive login suits a person exploring; a scheduled run needs a method that does not wait for someone to log in. (Meridian's view)

The method

In DuckDB, secrets are temporary by default, held in memory for the life of the DuckDB instance, while persistent secrets are read from disk and loaded automatically when DuckDB starts.[1] In DuckDB, a persistent secret is created with the CREATE PERSISTENT SECRET command.[1] A DuckDB secret can have a scope, a file path prefix it applies to, and when several secrets match a path the one with the longest prefix is chosen.[1] For AWS S3, Google Cloud Storage, Cloudflare R2 and Azure secrets, DuckDB supports two providers: CONFIG, which takes all the configuration in the CREATE SECRET statement, and credential_chain, which tries to fetch credentials automatically.[1]

In KNIME's OAuth2 Authenticator, the user logs in to the authentication service in a new browser window, which is redirected with an authorization code that the node uses to acquire an access token.[2]

Sources

  1. [1]Secrets Manager – DuckDBdocumentation
  2. [2]OAuth2 Authenticatordocumentation
  3. [3]Use of hard-coded password | OWASP Foundationsecondary source
  4. [4]CREATE SECRET Statement – DuckDBdocumentation