Create and Map Credential Objects

Create and Own Credential Objects

Create credentials in the schema that owns the external object or database-local catalog mapping unless a documented central-ownership model is required. Values enclosed in angle brackets are placeholders that you replace through your secure deployment process.

BEGIN
  DBMS_CLOUD.CREATE_CREDENTIAL(
    credential_name => 'DATA_STORAGE_CREDENTIAL',
    username => '<storage_principal>',
    password => '<storage_secret>'
  );
END;
/

Use the OCI signing-key overload only for an operation that requires OCI request signing:

BEGIN
  DBMS_CLOUD.CREATE_CREDENTIAL(
    credential_name => 'OCI_SIGNING_KEY_CREDENTIAL',
    user_ocid => '<user_ocid>',
    tenancy_ocid => '<tenancy_ocid>',
    private_key => '<private_key>',
    fingerprint => '<fingerprint>'
  );
END;
/

Credential objects are schema objects. Verify a stored credential through USER_CREDENTIALS:

SELECT credential_name, username, enabled, comments
FROM user_credentials
WHERE credential_name = 'DATA_STORAGE_CREDENTIAL';

The view exposes credential metadata, not the stored secret. Deployment-provided cloud principal identities can use different service-specific metadata.

Map Catalog and Storage Credentials

DBMS_CATALOG mounts and manages a supported catalog in one database. Its provider-specific procedures associate the catalog connection with a catalog credential and a data-storage credential, or map catalog-required credential names to local database credentials.

Do not use a generic mount example here: required parameters, endpoint forms, credential types, and catalog values differ by implementation. Use the provider-specific procedures and Iceberg requirements in Chapter 4, and the Native Iceberg requirements in Section Create and Manage Iceberg Tables with Oracle SQL.