--- schema_version: "1" id: d3b6b578730a7e02a1c65512e43a1fa5a23df4bf727347fa19c95712728b19ba title: OAuth Connections collection: tableau version: current locale: en-gb portal_url: https://docs.salesforce.com/tableau/current/en-gb/online/protected_auth.md canonical_url: https://help.tableau.com/current/online/en-gb/protected_auth.htm source_site: help.tableau.com content_type: documentation content_hash: 3c1560b71b14e2d3dd8231e8c434f50163b6ebca09a052caeea9645d1a64bcf0 description: Use OAuth connections to avoid storing database credentials in Tableau. --- [Skip to main content](#main-content) # OAuth Connections An alternative to storing your sensitive database credentials with Tableau Cloud or Tableau Server is to create connections using the **OAuth 2.0** standard. The following connectors support OAuth authentication:  - Amazon Athena - Anaplan - Azure Data Lake Storage Gen2, Azure SQL, Azure Synapse - Box - Esri ArcGIS Server - Databricks - Denodo - Dremio - Dropbox - Google Ads, Google Analytics, Google BigQuery, Google Drive - Impala - LinkedIn Sales Navigator - Marketo - OneDrive and SharePoint Online - Oracle Eloqua - QuickBooks Online - Salesforce, Salesforce CDP - SAP HANA - ServiceNow ITSM - Snowflake From Tableau, when users sign in to data with a connector that uses OAuth, users are redirected to the authentication provider’s sign-in page. After users provide their credentials and authorise Tableau to access their data, the authentication provider sends Tableau an **access token** that uniquely identifies Tableau and the users. This access token is used to access data on users' behalf. For more information, see [Overview of the OAuth process](#Overview) below. Using OAuth-based connections provides the following benefits: - **Security:** Your database credentials are never known to or stored in Tableau Cloud, and the access token can be used only by Tableau on behalf of users. - **Convenience:** Instead of having to embed your data source ID and password in multiple places, you can use the token provided for a particular data provider for all published workbooks and data sources that access that data provider. **Note:** For live connections to Google BigQuery data, each workbook viewer can have a unique access token that identifies the user, rather than sharing a single username and password credential. ## Overview of the OAuth process The following steps describe a workflow in the Tableau environment that calls the OAuth process. 1. A user takes an action that requires access to a cloud-based data source. For example, you open a workbook that’s published to Tableau Cloud. 2. Tableau directs the user to the cloud data provider’s sign-in page. The information that is sent to the data provider identifies Tableau as the requesting site. 3. When the user signs in to the data, the provider prompts the user to confirm their authorisation for Tableau Cloud to access the data. 4. Upon the user's confirmation, the data provider sends an access token back to Tableau Cloud. 5. Tableau Cloud presents the workbook and data to the user. ![A diagram of the data flow between your laptop, Tableau Cloud and your database.](/tableau/current/en-gb/online/en-gb/Img/protected_auth_online.png) **Note**: Support for single use refresh tokens (sometimes called one-time use refresh tokens, rolling refresh tokens or refresh token rotation) for OAuth connections was added in Tableau Cloud with the 2025.2 (Summer 2025) release and added in Tableau Server with the 2025.3 release if the IDP of the data source provider supports it. These are not yet supported on Tableau Bridge connections to Tableau Cloud. If you use the external OAuth configuration for the connection, please see the [OAuth Configuration and Usage documentation](https://tableau.github.io/connector-plugin-sdk/docs/oauth "OAuth Config docs") in GitHub for more information. The following user workflows can use the OAuth process: - Creating a workbook and connecting to the data source from Tableau Desktop or from Tableau Cloud. - Publishing a data source from Tableau Desktop. - Signing in to a Tableau Cloud site from an approved _client_, such as Tableau Mobile or Tableau Desktop. - Using Tableau Bridge to access on-premises data. See [Connectivity with Bridge](https://help.tableau.com/current/online/en-gb/to_sync_local_data.htm#authentication). ## Default saved credential connectors _Saved credentials_ refers to the functionality where Tableau Cloud stores user tokens for OAuth connections. This allows users to save their OAuth credentials to their user profile on Tableau Cloud. After they’ve saved the credentials, they won’t be prompted when they subsequently publish, edit or refresh when accessing the connector. **Note**: When editing Tableau Prep flows on the web, you may still be prompted to reauthenticate. All supported connectors are listed under Saved Credentials for Data Sources on users’ My Account Settings page on Tableau Cloud. Users manage their saved credentials for each connector. ### Access tokens for data connections You can embed credentials based on access tokens with data connections, to enable direct access after the initial authentication process. An access token is valid until a Tableau Cloud user deletes it, or the data provider revokes it. It’s possible to exceed the number of access tokens your data source provider allows. If that's the case, when a user creates a token, the data provider uses the length of time since last access to decide which token to invalidate to make room for the new one. ### Access tokens for authentication from approved clients By default, Tableau Cloud sites allow users to access their sites directly from approved Tableau clients, after users provide their credentials the first time they sign in. This type of authentication also uses OAuth access tokens to store the users' credentials securely. For more information, see [Access Sites from Connected Clients](https://help.tableau.com/current/online/en-gb/to_connected_clients.htm). ## Default-managed keychain connectors _Managed keychain_ refers to the functionality where OAuth tokens are generated for Tableau Cloud by the provider and shared by all users in the same site. When a user first publishes a data source, Tableau Server prompts the user for the data source credentials. Tableau Cloud submits the credentials to the data source provider, which returns OAuth tokens for Tableau Cloud to use on behalf of the user. On subsequent publishing operations, the OAuth token stored by Tableau Cloud for the same class and username is used so that the user isn’t prompted for the OAuth credentials. Should the data source password change, then the preceding process is repeated and the old token is replaced by a new token on Tableau Cloud. Additional OAuth configuration on Tableau Cloud isn't required for the default-managed keychain connectors: - Google Analytics, Google BigQuery and Google Sheets (deprecated in March 2022) - Salesforce ## Configure custom OAuth Beginning with 2021.2, as a site admin, you can configure a custom OAuth client, for each OAuth supported data provider (connector), to override the pre-configured OAuth client settings for your site. You might consider configuring a custom OAuth client to support securely connecting to data that requires unique OAuth clients. When a custom OAuth client is configured, default configurations are ignored and all new OAuth credentials created on the site use the custom OAuth client by default. **Important:** Existing OAuth credentials established before the custom OAuth client is configured are temporarily usable but both site admins and users must update saved credentials to help ensure uninterrupted data access. ### Step 1: Prepare the OAuth client ID, client secret and redirect URL Before you can configure the custom OAuth client, you must collect the information listed after this. After you have this information, you can configure the custom OAuth client for each of the OAuth supported connector. - **OAuth client ID and client secret:** First register the OAuth client with the data provider (connector) to retrieve the client ID and client secret. Supported connectors include: - Azure Data Lake Storage Gen2, Azure SQL Database, Azure Synapse - Databricks - Dremio - Dropbox - Google Analytics, Google BigQuery, Google Sheets (deprecated in March 2022) - Impala - Intuit Quick books Online - Salesforce, Salesforce CDP - Snowflake (For more information, see [OAuth Configuration and Usage](https://tableau.github.io/connector-plugin-sdk/docs/oauth) in the Tableau Connector SDK documentation.) - **Redirect URL:** Note the pod where your Tableau Cloud site is located to ensure you enter the correct redirect URL during the registration process in **Step 2** below. The redirect URL uses the following format: https://.online.tableau.com/auth/add\_oauth\_token For example, https://us-west-2b.online.tableau.com/auth/add\_oauth\_token **Note:** For more information about pods, see the [Salesforce Trust](https://status.salesforce.com/products/tableau) page. If you have set up a custom domain for your site, the OAuth client must use the custom domain as the redirect URL. For example, if your custom domain is ‘analytics.example.com’, the redirect URL will be ‘https://analytics.example.com/auth/add\_oauth\_token’. For more information, see [Use a Custom Domain with Tableau Cloud](https://help.tableau.com/current/online/en-gb/custom_domain.htm). ### Step 2: Register OAuth client ID and client secret Follow the procedure described below to register the custom OAuth client to your site. 1. Sign in to Tableau Cloud using your site admin credentials and navigate to the Settings page. 2. Under OAuth Clients Registry, click the Add OAuth Client button. 3. Enter the required information, including the information from **Step 1** above: **Note:** Leave the OAuth Instance URL field blank unless you are using multiple OAuth clients. 1. For Connection Type, select a database class value that corresponds to the connector whose custom OAuth client you want to configure. 2. For Client ID, Client Secret and Redirect URL, enter the information you prepared in **Step 1** above. 3. Click the Add OAuth Client button to complete the registration process. ![A form for the creation of an OAuth client, including fields for connection type, OAuth instance URL, client ID, client secret and redirect URL.](/tableau/current/en-gb/online/en-gb/Img/oauth_custom.png) 4. (Optional) Repeat step 3 for additional connectors. 5. Click the Save button at the bottom or top of the Settings page to save changes. ### Step 3: Validate and update saved credentials To help ensure uninterrupted data access, you (and your site users) must delete the previous saved credentials and add it again to use the custom OAuth client instead of the default OAuth client. 1. Navigate to your My Account Settings page. 2. Under Saved Credentials for Data Sources, do the following: 1. Click Delete next to the existing saved credentials for the connector whose custom OAuth client you configured in **Step 2** above. 2. Next to the same connector, click Add and follow the prompts to 1) connect to the custom OAuth client configured in **Step 2** above and 2) save the latest credentials. ### Step 4: Notify users to update their saved credentials Make sure you notify your site users to update their saved credentials for the data provider whose custom OAuth client you configured in **Step 2** above. Site users can use the procedure described in [Update saved credentials](https://help.tableau.com/current/online/en-gb/manage_stored_credentials.htm#oauth_update_credentials) to update their saved credentials. ## Other articles in this section