> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://help.sigmacomputing.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://help.sigmacomputing.com/_mcp/server.

# Add and manage secrets (Beta)

> Add secrets to a secret manager integration in Sigma and manage them to authenticate connections and API connectors.

This documentation describes one or more public beta features that are in development. Beta features are subject to quick, iterative changes; therefore the current user experience in the Sigma service can differ from the information provided in this page.

This page should not be considered official published documentation until Sigma removes this notice and the beta flag on the corresponding feature(s) in the Sigma service. For the full beta feature disclaimer, see [Beta features](/docs/sigma-product-releases#beta-features).

The use of secret manager integrations is subject to the following [disclaimer](/docs/notice-for-the-use-of-secret-managers-in-sigma).

After an organization admin has [set up a secret manager integration](/docs/set-up-secret-manager-integration), you can add, use, edit and delete secrets in Sigma. You can also view where these secrets are being used.

## User requirements

* An organization admin must have set up a secret manager integration in Sigma. See [Set up secret manager integration](/docs/set-up-secret-manager-integration).

* The secret manager integration must have secrets available to use in Sigma. See the documentation for your secret manager platform for more information on how to add secrets.

* You must be assigned the Admin [account type](/docs/create-and-manage-account-types) to add, use, edit, delete, and view secrets in a secret manager integration.

## Add secrets to a secret manager integration

To add a secret to your secret manager integration:

1. Go to **Administration** > **Authentication**.

2. Select the **Secret managers** tab.

3. Select the secret manager integration that you want to add a secret to.

4. In the **Secrets** tab, select **Add secret**.

5. Enter the required information:

   * **Secret name**: A friendly name for use within Sigma.

   * **Secret reference**:

     * **HashiCorp Vault**: The path to the secret in Vault. If you are using KV secrets engine version 1, use the format `/v1/<mount_path>/<path_to_secret>/<secret_name>`. If you are using KV secrets engine version 2, use the format `/v1/<mount_path>/data/<path_to_secret>/<secret_name>`. If you are unsure which version you are using, see the HashiCorp Vault documentation on <a href="https://developer.hashicorp.com/vault/docs/secrets/kv" target="_blank">KV secrets engine</a>.
     * **AWS Secrets Manager**: The secret name or ARN from your AWS Secrets Manager.

   * **Secret format**: Select **JSON**, **Plain text**, **Base64**, or **Base64-encoded JSON**.

   * **Key path**: (Required for **JSON** and **Base64-encoded JSON** formats) The location of your desired value inside your secret's JSON structure. For example, if your secret is stored as:
     ```json
     {
       "username": "user",
       "password": "<password>",
       "password2": {
         "value": "<password2>"
       }
     }
     ```
     The **Key path** for `password` is `password` and the **Key path** for `password2` is `password2.value`. See [Use dot notation to extract values from JSON columns](/docs/extract-columns-from-json-or-variant-data#use-dot-notation-to-extract-values-from-json-objects) for more information.

6. Select **Add**. Your secret appears in the table of secrets available through the secret manager integration.

7. Test the secret to ensure that Sigma can access it. Next to the name of the secret, select <img src="https://sigma-docs-screenshots.s3.us-west-2.amazonaws.com/Icons/more.svg" alt="" /> **More**, then select **Test**. A success message is shown if Sigma can access the secret.

## Use secrets in Sigma

You can use secrets from your secret manager integration when you configure data platform [connections](#use-secrets-when-configuring-connections) and [API connectors](#use-secrets-when-configuring-api-connectors).

### Use secrets when configuring connections

When setting up data platform connections in Sigma, you can use secrets from your secret manager integration to authenticate the connection:

| Connection                                          | Supported credentials                                                                                                                                                                    |
| --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [AlloyDB](/docs/connect-to-alloydb)                 | Password                                                                                                                                                                                 |
| [Azure SQL DB](/docs/connect-to-azure-sql-database) | Password                                                                                                                                                                                 |
| [BigQuery](/docs/connect-to-bigquery)               | Service account JSON key (basic authentication, or OAuth with a service account)<br />OAuth client secret (connection-level OAuth)                                                       |
| [ClickHouse](/docs/connect-to-clickhouse)           | Password                                                                                                                                                                                 |
| [Databricks](/docs/connect-to-databricks)           | Access token (basic authentication, or OAuth with a service account)<br />OAuth client secret (connection-level OAuth)                                                                   |
| [MySQL](/docs/connect-to-mysql)                     | Password                                                                                                                                                                                 |
| [PostgreSQL](/docs/connect-to-postgresql)           | Password                                                                                                                                                                                 |
| [Redshift](/docs/connect-to-redshift)               | Password                                                                                                                                                                                 |
| [Snowflake](/docs/connect-to-snowflake)             | Password (basic authentication)<br />Private key and private key passphrase (key-pair authentication, or OAuth with a service account)<br />OAuth client secret (connection-level OAuth) |
| [SQL Server](/docs/connect-to-sql-server-2022)      | Password                                                                                                                                                                                 |
| [Starburst](/docs/connect-to-starburst)             | Password                                                                                                                                                                                 |

### Use secrets when configuring a credential for an API connector

You can use secrets from your secret manager integration when you configure API connector credentials. For more information, see [Configure API credentials and connectors in Sigma](/docs/configure-api-credentials-and-connectors-in-sigma).

## Manage existing secrets

### Edit secrets

To edit an existing secret in Sigma:

1. Go to **Administration** > **Authentication**.
2. Select the **Secret managers** tab.
3. Select the secret manager integration that contains the secret that you want to edit.
4. In the **Secrets** tab, select <img src="https://sigma-docs-screenshots.s3.us-west-2.amazonaws.com/Icons/more.svg" alt="" /> **More**, then select **Edit**.
5. Update the required information.
6. Select **Save**.
7. Test the edited secret to ensure that Sigma can access it. Next to the name of the secret, select <img src="https://sigma-docs-screenshots.s3.us-west-2.amazonaws.com/Icons/more.svg" alt="" /> **More**, then select **Test**. A success message is shown if Sigma can

### Delete secrets

To delete an existing secret in Sigma:

1. Go to **Administration** > **Authentication**.
2. Select the **Secret managers** tab.
3. Select the secret manager integration that contains the secret that you want to delete.
4. In the **Secrets** tab, select <img src="https://sigma-docs-screenshots.s3.us-west-2.amazonaws.com/Icons/more.svg" alt="" /> **More**, then select **Delete**.
5. Select **Delete**.

### View secrets and secret usage

To view all secrets available in a specific secret manager integration and where these secrets are being used:

1. Go to **Administration** > **Authentication**.
2. Select the **Secret managers** tab.
3. Select the secret manager integration that you want to view.
4. View the information in the **Secrets** and **Secret access** tabs:
   * **Secrets**: View a list of all secrets available in the secret manager integration and search for specific secrets.
   * **Secret access**: View which connections and API connectors are currently using specific secrets.

## Secret management and maintenance

### Rotate public keys

Vault integrations that use the **Self-signed JWT** authentication method use a public key to authenticate with Vault. Regularly rotating the public key is a best practice to enhance security.

To rotate the public key:

1. Go to **Administration** > **Authentication**.
2. Select the **Secret managers** tab.
3. Select the secret manager integration that you want to rotate the public key for.
4. In the **Public keys** section, select **Create new key**. A new public key appears.
5. Configure your Vault instance to recognize this new key. See the HashiCorp Vault documentation on <a href="https://developer.hashicorp.com/vault/api-docs/auth/jwt#jwt_validation_pubkeys" target="_blank">jwt\_validation\_pubkeys</a> for more information.
6. In Sigma, activate your new key. In the **Public keys** section, next to the new key, select <img src="https://sigma-docs-screenshots.s3.us-west-2.amazonaws.com/Icons/more.svg" alt="" /> **More**, then select **Activate**.
7. Delete the old key. Next to the old key, select <img src="https://sigma-docs-screenshots.s3.us-west-2.amazonaws.com/Icons/more.svg" alt="" /> **More**, then select **Delete**.

## Related resources

* [Set up secret manager integration](/docs/set-up-secret-manager-integration)
* [Configure API credentials and connectors in Sigma](/docs/configure-api-credentials-and-connectors-in-sigma)