---
metadata:
  - name: generator
    content: Diplodoc Platform v5.52.0
alternate:
  - https://ydb-platform--ydb.viewer.diplodoc.com/en/concepts/datamodel/secrets.md?version=v25.3
  - https://ydb-platform--ydb.viewer.diplodoc.com/ru/concepts/datamodel/secrets.md?version=v25.3
  - href: en/concepts/datamodel/secrets.md
    type: text/markdown
    title: Markdown version
  - href: ../../llms.txt
    type: text/markdown
    title: llms.txt
sourcePath: en/core/concepts/datamodel/secrets.md
---
> **Documentation Index:** Fetch the complete configuration index at https://ydb-platform--ydb.viewer.diplodoc.com/en/llms.txt

# Secrets

{% note warning %}

This functionality is in "Preview" mode.

{% endnote %}

To work with external data sources in YDB, [federated queries](https://ydb-platform--ydb.viewer.diplodoc.com/en/concepts/query_execution/federated_query/index.md?version=v25.3) are used. Federated queries utilize various access credentials for authentication in external systems. These credentials are stored in separate objects called secrets. Secrets are only available for writing and updating; their values cannot be retrieved.

{% note warning %}

The current syntax for working with secrets is temporary and will be changed in future releases of YDB.

{% endnote %}

## Creating Secrets {#create_secret}

Secrets are created using an SQL query:

```yql
CREATE OBJECT `MySecretName` (TYPE SECRET) WITH value=`MySecretData`;
```

## Access Management {#secret_access}

All rights to use the secret belong to its creator. The creator can grant another user read access to the secret through [access management](#secret_access) for secrets.

Special objects called `SECRET_ACCESS` are used to manage access to secrets. To grant permission to use the secret `MySecretName` to the user `another_user`, a `SECRET_ACCESS` object named `MySecretName:another_user` must be created:

```yql
CREATE OBJECT `MySecretName:another_user` (TYPE SECRET_ACCESS)
```