Connect Trino or Starburst with OAuth

When to use this

You want a Trino or Starburst cluster behind a swarmvia endpoint, with agents authenticating as a service identity through your identity provider instead of a shared password. The Trino JDBC driver is on Maven Central and accepts an access token you supply.

Setup

1. The cluster

Trino needs TLS and an authenticator for anything but anonymous access. Enable OAuth2 authentication (http-server.authentication.type=oauth2) with your provider, or password authentication for a file or LDAP user. Catalog and schema access rules in access-control are the boundary; Trino does not have a read-only connection to honour, so grant SELECT and nothing else.

2. The source

Sources → New source → JDBC data source → Trino / Starburst. The preset fetches io.trino:trino-jdbc. Placeholders: host, port 443, catalog. The public property SSL=true is set for you.

jdbc:trino://trino.acme.internal:443/hive

3. The credential

OAuth 2.0 client credentials: the provider's token URL, client id and secret, the audience or scope your Trino authenticator checks, token property accessToken.

Password authentication is the public property user on the source and the secret property password on the credential.

4. Query

curl https://trino.swarmvia.cloud \
  -H "X-Swarmvia-Key: $SWARMVIA_KEY" \
  -H "content-type: application/json" \
  -d '{"queries":[{"sql":"SELECT region, count(*) FROM sales.orders WHERE order_date >= date(?) GROUP BY 1","params":["2026-01-01"]}]}'

Tips

Trino federates catalogs; source_schema lists the catalog in the URL. Create one source per catalog an agent should reach, each with its own concurrency limit, rather than one source over everything.
Starburst Galaxy uses the same preset; its host ends in .galaxy.starburst.io and its OAuth is the Galaxy token endpoint.
Queries that scan object storage run long; set waitMs and let the source hand back a job rather than holding the HTTP request open.