--- schema_version: "1" id: 6f6c4583fe35a3b9aa7810b597da1c67bd0567b77060509d8d615ee60f3d2ad0 title: OAuth Connections collection: tableau version: next locale: en-us portal_url: https://docs.salesforce.com/tableau/next/en-us/server-linux/protected_auth.md canonical_url: https://help.tableau.com/v0.0/server-linux/en-us/protected_auth.htm source_site: help.tableau.com content_type: documentation content_hash: fa1cafa41f066156e7b1abfc4596dc07c643e01fc559424e561e708ae14358c9 description: Use OAuth connections to avoid storing database credentials in Tableau. --- [Skip to main content](#main-content) # OAuth Connections Tableau Server supports OAuth for a number of different connectors. In many cases, OAuth functionality doesn’t require additional configuration on Tableau Server. From Tableau, when users sign in to data with a connector that uses OAuth, users are redirected to the authentication provider’s sign in page. After users provide their credentials and authorize Tableau to access their data, the authentication provider sends Tableau an **access token** that uniquely identifies Tableau and the users. This access token is used to access data on users' behalf. For more information, see [Overview of the OAuth process](#Overview) below. Using OAuth-based connections provides the following benefits: - **Security:** Your database credentials are never known to or stored in Tableau Server, and the access token can be used only by Tableau on behalf of users. - **Convenience:** Instead of having to embed your data source ID and password in multiple places, you can use the token provided for a particular data provider for all published workbooks and data sources that access that data provider. **Note:** For live connections to Google BigQuery data, each workbook viewer can have a unique access token that identifies the user, rather than sharing a single username and password credential. ## Overview of the OAuth process The following steps describe a workflow in the Tableau environment that calls the OAuth process. 1. A user takes an action that requires access to a cloud-based data source. For example, you open a workbook that’s published to Tableau Server. 2. Tableau directs the user to the cloud data provider’s sign in page. The information that is sent to the data provider identifies Tableau as the requesting site. 3. When the user signs in to the data, the provider prompts the user to confirm their authorization for Tableau Server to access the data. 4. Upon the user's confirmation, the data provider sends an access token back to Tableau Server. 5. Tableau Server presents the workbook and data to the user. ![A diagram of the data flow between your laptop, Tableau Server, and your database.](/tableau/next/en-us/server-linux/en-us/Img/protected_auth_server.png) **Note**: Support for single use refresh tokens (sometimes called one-time use refresh tokens, rolling refresh tokens, or refresh token rotation) for OAuth connections was added in Tableau Cloud with the 2025.2 (Summer 2025) release and added in Tableau Server with the 2025.3 release if the IDP of the data source provider supports it. These are not yet supported on Tableau Bridge connections to Tableau Cloud. If you use the external OAuth configuration for the connection, please see the [OAuth Configuration and Usage documentation](https://tableau.github.io/connector-plugin-sdk/docs/oauth "OAuth Config docs") in GitHub for more information. The following user workflows can use the OAuth process: - Creating a workbook and connecting to the data source from Tableau Desktop or from Tableau Server. - Publishing a data source from Tableau Desktop. - Signing in to Tableau Server from an approved _client_, such as Tableau Mobile or Tableau Desktop. ## Default saved credential connectors _Saved credentials_ refers to the functionality where Tableau Server stores user tokens for OAuth connections. This allows users to save their OAuth credentials to their user profile on Tableau Server. After they’ve saved the credentials, they won’t be prompted when they subsequently publish, edit, or refresh when accessing the connector. **Note**: When editing Tableau Prep flows on the web, you may still be prompted to reauthenticate. The following connectors use saved credentials by default and don’t require additional configuration on Tableau Server. - Anaplan - Box - Dropbox - Esri ArcGIS Server - Google Ads - LinkedIn Sales Navigator - Marketo - OneDrive and SharePoint Online (Additional configuration is required starting with 2022.3) - Oracle Eloqua - ServiceNow ITSM - Snowflake - To use "private link" requires additional configuration. For more information, see [Configure Snowflake OAuth for Partner Applications](https://docs.snowflake.net/manuals/user-guide/oauth-partner.html#configure-snowflake-oauth-for-partner-applications) on the Snowflake website and [Configure OAuth for Snowflake Connections on Tableau Server](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_snowflake.htm). The following connectors can use saved credentials with additional configuration by the server administrator. - Amazon Athena For more information, see [Use Your Own Identity Provider With Amazon Athena](https://help.tableau.com/current/pro/desktop/en-us/amazon_athena_idp.htm) in the Tableau Desktop Help. - Azure Data Lake Storage Gen2, Azure Synapse, Azure SQL Database, Databricks, OneDrive and SharePoint Online, and SharePoint Lists (JDBC) For more information, see [Configure Azure AD for OAuth and Modern Authentication](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_azure_ad.htm). - Dremio For more information, see [Set Up OAuth for Dremio](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_dremio.htm). - Google Analytics, Google BigQuery, Google BigQuery (JDBC), Google Drive For more information, see [Set up OAuth for Google.](https://help.tableau.com/current/server/en-us/config_oauth_google.htm) **Note:** If Tableau Server isn’t listed in the Accessed Apps list in the Google admin console, you can manually add a new app to the list using its client ID. To create a client ID, see [Change Google OAuth to Saved Credentials.](https://help.tableau.com/current/server/en-us/config_oauth_google.htm) - Intuit QuickBooks Online For more information, see [Set Up OAuth for Intuit QuickBooks Online](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_qbo.htm). OneDrive and SharePoint Online (Starting with 2022.3) For more information, see [Configure Custom OAuth for a site](https://help.tableau.com/current/server/en-us/config_oauth_azure_ad.htm#custom) - Salesforce For more information, see [Change Salesforce.com OAuth to Saved Credentials](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_sfdc.htm). - Salesforce CDP For more information, see [Connect Tableau Server to Salesforce Data Cloud](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_sfdc_cdp.htm). - Snowflake Starting with version 2024.2. For more information, see [Change Snowflake OAuth to Saved Credentials](https://help.tableau.com/current/server/en-us/config_oauth_snowflake.htm). All supported connectors are listed under Saved Credentials for Data Sources on users’ My Account Settings page on Tableau Server. Users manage their saved credentials for each connector. ![A list of saved crecentials for data sources, with an option to clear all saved credentials.](/tableau/next/en-us/server-linux/en-us/Img/oauth-savedcreds.png) ### Access tokens for data connections You can embed credentials based on access tokens with data connections, to enable direct access after the initial authentication process. An access token is valid until a Tableau Server user deletes it, or the data provider revokes it. It’s possible to exceed the number of access tokens your data source provider allows. If that's the case, when a user creates a token, the data provider uses the length of time since last access to decide which token to invalidate to make room for the new one. ### Access tokens for authentication from approved clients By default, Tableau Server sites allow users to access their sites directly from approved Tableau clients, after users provide their credentials the first time they sign in. This type of authentication also uses OAuth access tokens to store the users' credentials securely. For more information, see [Disable Automatic Client Authentication](https://help.tableau.com/v0.0/server-linux/en-us/devices_connected_credentials.htm). ## Default-managed keychain connectors _Managed keychain_ refers to the functionality where OAuth tokens are generated for Tableau Server by the provider and shared by all users in the same site. When a user first publishes a data source, Tableau Server prompts the user for the data source credentials. Tableau Server submits the credentials to the data source provider, which returns OAuth tokens for Tableau Server to use on behalf of the user. On subsequent publishing operations, the OAuth token stored by Tableau Server for the same class and username is used so that the user isn’t prompted for the OAuth credentials. Should the data source password change, then the preceding process is repeated and the old token is replaced by a new token on Tableau Server. Additional OAuth configuration on Tableau Server isn't required for the default-managed keychain connectors: - Google Analytics, Google BigQuery, and Google Sheets (deprecated in Tableau version 2022.1) - Salesforce ### Token limits and storage Google has a 50 token limit per user per client application (in this scenario, Tableau Server is the client application). Because the OAuth token is stored on Tableau Server and reused by the user, the user is unlikely to exceed the token limit. All user tokens are encrypted at rest when stored on Tableau Server. See [Manage Server Secrets](https://help.tableau.com/v0.0/server-linux/en-us/security_secret_storage.htm) for more information. ### Removing unused keychain records A managed keychain record contains connection attributes like dbClass, username, and OAuth secret attributes. All managed keychain records for a given site are merged, encrypted, and stored in PostgreSQL. Records are persisted even for workbooks and data sources that have been removed. Over time, these records can grow to large sizes, which may cause issues. We recommend purging the unused keychain records periodically as a regular maintenance task. You can view the number of records and unused records stored on each site. You can also delete unused records. ![A dialog box for the management of saved credential keychains. The dialog box includes an option to display the number of unused keychains and a button to delete them.](/tableau/next/en-us/server-linux/en-us/Img/oauth-purge-managed-keys.png) To access Managed Keychain Clean Up, sign in to the Tableau Server admin pages, navigate to the site where you want to delete unused records, and click Settings. ### Scenario limitations with managed keychain Three scenarios aren’t supported when using managed keychain OAuth with Tableau Server: - Prompting for OAuth credentials on live connections. Users must embed credentials on live connections with managed-keychain OAuth - Editing the OAuth data source connection on Tableau Server - Web authoring ### Convert managed keychain to saved credentials You can convert the connectors that use managed keychain to use saved credentials by configuring Tableau Server with an OAuth client ID and secret for each connector. By converting these connectors to saved credentials, users are able to manage their credentials for each connector type on the My Account Settings page on Tableau Server. Additionally, live connection prompts, editing connections, and web authoring are also supported. ## Configure a custom OAuth for a site For a subset of connectors, you can configure site-level OAuth by configuring custom OAuth clients. For more information, see one of the following topics: - For Azure Data Lake Storage Gen2, Azure SQL Database, Azure Synapse, Databricks, OneDrive and SharePoint Online, and SharePoint Lists (JDBC), see [Configure custom OAuth for a site](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_azure_ad.htm#custom). - For Dremio, see [Set Up OAuth for Dremio](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_dremio.htm). - For Google Analytics, Google BigQuery, Google Sheets (deprecated in Tableau version 2022.1), see [Configure custom OAuth for a site](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_google.htm#custom). - For Salesforce, see [Configure custom OAuth for a site](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_sfdc.htm#custom). - For Salesforce CDP, see [Connect Tableau Server to Salesforce Data Cloud](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_sfdc_cdp.htm#custom). - For Snowflake, see [Option 2: Configure OAuth for Snowflake Connections by Site](https://help.tableau.com/v0.0/server-linux/en-us/config_oauth_snowflake.htm#custom). ## Other articles in this section