# Connect Trino or Starburst with OAuth

## When to use this

You want a Trino or Starburst cluster behind a swarmvia endpoint, with agents
authenticating as a service identity through your identity provider instead of
a shared password. The Trino JDBC driver is on Maven Central and accepts an
access token you supply.

## Setup

### 1. The cluster

Trino needs TLS and an authenticator for anything but anonymous access. Enable
OAuth2 authentication (`http-server.authentication.type=oauth2`) with your
provider, or password authentication for a file or LDAP user. Catalog and
schema access rules in `access-control` are the boundary; Trino does not have
a read-only connection to honour, so grant `SELECT` and nothing else.

### 2. The source

**Sources → New source → JDBC data source → Trino / Starburst.** The preset
fetches `io.trino:trino-jdbc`. Placeholders: host, port `443`, catalog. The
public property `SSL=true` is set for you.

```
jdbc:trino://trino.acme.internal:443/hive
```

### 3. The credential

**OAuth 2.0 client credentials**: the provider's token URL, client id and
secret, the audience or scope your Trino authenticator checks, token property
`accessToken`.

Password authentication is the public property `user` on the source and the
secret property `password` on the credential.

### 4. Query

```bash
curl https://trino.swarmvia.cloud \
  -H "X-Swarmvia-Key: $SWARMVIA_KEY" \
  -H "content-type: application/json" \
  -d '{"queries":[{"sql":"SELECT region, count(*) FROM sales.orders WHERE order_date >= date(?) GROUP BY 1","params":["2026-01-01"]}]}'
```

## Tips

- Trino federates catalogs; `source_schema` lists the catalog in the URL.
  Create one source per catalog an agent should reach, each with its own
  concurrency limit, rather than one source over everything.
- Starburst Galaxy uses the same preset; its host ends in `.galaxy.starburst.io`
  and its OAuth is the Galaxy token endpoint.
- Queries that scan object storage run long; set `waitMs` and let the
  source hand back a job rather than holding the HTTP request open.

## See also

- [JDBC sources](/docs/sources/jdbc)
- [Async](/docs/sources/async)