Authentication Methods

Data Connectors use different authentication methods depending on how each service verifies users and applications. CamberCloud encrypts saved credentials and uses them only to connect to the service you configure. All credential values shown below are examples only.

OAuth 2.0

OAuth 2.0 redirects you to the provider to sign in and approve access. The provider then gives CamberCloud a token, so you do not need to share your password with CamberCloud.

Username / Password

Username and password authentication signs in with credentials created in the connected service. When possible, use a dedicated account with only the permissions CamberCloud needs.

Access Token

An access token is a secret string generated by the provider. It can replace a password and may have limited permissions or an expiration date.

Access Token: <provider-generated-token>

API Key

An API key is a secret string that identifies a user or application when it calls an API. Create a key with the minimum permissions required and rotate it if it is exposed.

API Key: phx_••••••••

Private Key

Private key authentication uses a key pair. You register the public key with the provider, while CamberCloud uses the private key to sign authentication requests without sending the private key to the provider.

-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----

IAM Role

An AWS IAM role lets CamberCloud request temporary credentials through a trust policy. This avoids storing long-lived AWS access keys for the connection.

Role ARN: arn:aws:iam::123456789012:role/camber-read-only

Access Key

AWS access key authentication uses an Access Key ID and a Secret Access Key to sign requests. The Access Key ID identifies the credential, while the Secret Access Key must remain private.

Access Key ID: AKIAIOSFODNN7EXAMPLE
Secret Access Key: ••••••••••••••••

Service Account

A service account is a non-human identity created for an application or automated workload. Its credentials and assigned roles control which resources CamberCloud can access.

{
  "type": "service_account",
  "client_email": "camber-reader@example-project.iam.gserviceaccount.com",
  "private_key": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----\n"
}

Supported authentication methods