ALTER CREDENTIAL
Valid in: SQL, ESQL, OpenAPI, ODBC, JDBC, .NET
The ALTER CREDENTIAL command modifies an existing credential and enables you to update one or more credential parameters.
This statement has the following format:
ALTER CREDENTIAL credential_name
SET TYPE = 'credential_type',
[,EXPIRE_DATE = 'timestamp']
[,ENDPOINT = 'endpoint_url']
[,REGION = 'region_name']
[,ACCESS = 'access_type']
[,SECRET = 'secret_key']
credential_name
(Required) Specifies the name of the credential to modify. The credential must be owned by the current user.
SET TYPE = 'credential_type'
Specifies the type of credential. Valid values are:
• AWS_SIMPLE - AWS basic authentication with access key and secret
• AWS_SESSION - AWS session-based authentication
• AWS_TOKEN - AWS token-based authentication
• GCS_SERVICE_1 - Google Cloud Storage service account
• GCS_TOKEN - Google Cloud Storage token-based authentication
• AZURE_OAUTH2_CLIENT - Azure OAuth2 authentication
• AZURE_SHARED_KEY - Azure Shared Key authentication
• AZURE_TOKEN - Azure token-based authentication
• BASIC - Username/password authentication
• TOKEN - Generic token-based authentication
• OAUTH - OAuth authentication
Note: When the credential type is altered, the secret also needs to be altered so it matches the expected key-value pairs for the updated credential type. See
JSON Format for Credential Secrets for the key-value details for each credential type.
EXPIRE_DATE = 'timestamp'
Sets the expiration date for the credential as an annotation in the ANSI SQL YYYY-MM-DD HH:MM:SS[.F] [[+|-]HH:MM]] format. Additional formats for the timestamp input as mentioned in the
Timestamp Data Types topic are also supported, but it is recommended to use the ANSI SQL format. If no timezone is specified, the server's local timezone is used.
Note: This option is used for informational and tracking purposes only to manage credential life cycles. The credential provider, for example, AWS, GCS, Azure, and similar, controls the credential validity and expiration.
Note: While a fractional second part can be entered, it will be truncated and the expiration timestamp is stored with a granularity of seconds only.
ENDPOINT = 'endpoint_url'
Specifies the service endpoint URL for the credential.
REGION = 'region_name'
Specifies cloud region for services like AWS or Azure.
ACCESS = 'access_type'
Sets the access level for the credential. Valid values are:
• READ - Read-only access
• WRITE - Write-only access
• READ_WRITE - Full read and write access
Note: This option is used for informational purposes only.
SECRET = 'secret_key'
Specifies the secret key or token associated with the credential. The secret must be a JSON document with a structure specific to the credential type. Each credential type requires different JSON fields in the secret document.
Note: JSON field names are case-sensitive, and the key name should be in upper case. For example, AWS_ACCESS_KEY_ID.
Note: There are a few limitations to the JSON document, such as full Unicode character set not being currently available. To avoid any error, ensure to limit the inputs to printable ASCII or ISOx characters.
Permissions
Only the owner of a credential can alter it. If a schema is specified in the credential name, it must match the current user.
Related Statements
Last modified date: 09/11/2026