Secure credentials

What it is

Encrypted at rest. AGOL OAuth2 client-id/secret are stored encrypted in the catalog, using pgcrypto.
Key from the environment. The encryption key comes from the AGOL_FDW_KEY environment variable — never stored in the database itself.
Proactive token refresh. Access tokens are cached and refreshed ahead of expiry, so sync doesn't stall on auth.
Pluggable auth provider. AGOL Online (OAuth2) ships first; Enterprise/on-prem auth can be added.

Why it matters

A bridge to ArcGIS Online needs credentials to act on your behalf. agol_fdw keeps those credentials encrypted and key-separated, so a database dump alone can't hand them over.

See it

# provide the encryption key to the Postgres server process
export AGOL_FDW_KEY="<32-byte-key>"

-- register your AGOL app credentials (stored encrypted)
SELECT agol_fdw.register_credentials(
  client_id := '<client-id>',
  client_secret := '<client-secret>'
);

Treat AGOL_FDW_KEY like any other secret: manage it via your secrets manager or infrastructure env, rotate as needed, and don't commit it.

← Back to home

What it is

Why it matters

See it

Related