Security & Authentication
Relevant source files
The following files were used as context for generating this wiki page:
- docusaurus/platform_versioned_docs/version-2.1/connector-development/ux-handbook.md
- airbyte-integrations/developer-docs/destinations/preflight-checklist.md
- docusaurus/platform_versioned_docs/version-2.1/connector-development/writing-connector-docs.md
- docusaurus/platform_versioned_docs/version-1.7/contributing-to-airbyte/writing-docs.md
- docusaurus/platform_versioned_docs/version-1.6/contributing-to-airbyte/writing-docs.md
Security and authentication within Airbyte are considered the foundation of the system's "Hierarchy of Needs." Because Airbyte acts as an infrastructure component moving highly confidential data—such as revenue numbers, salaries, and sensitive documents—maintaining user trust through robust security measures is the top priority. This involves preventing credential leakage in logs or plain text and ensuring that no vulnerabilities exist within the product.
The security model extends from the platform level to individual connectors, requiring strict adherence to protocols for handling API keys, OAuth tokens, and database credentials. Developers must ensure that infrastructure components provide a secure environment that prevents the frivolous sharing of sensitive information over internal or external communication channels.
Sources: docusaurus/platform_versioned_docs/version-2.1/connector-development/ux-handbook.md:67-75, docusaurus/platform_versioned_docs/version-1.7/connector-development/ux-handbook.md:67-75
Authentication Mechanisms in Connectors
Airbyte supports several authentication methods depending on the source or destination being integrated. These methods are typically defined in the connector's specification file (spec.json).
Supported Auth Methods
- Username/Password: Standard credential-based access.
- API Keys: Token-based access for web services.
- OAuth: Delegated authorization, often requiring redirect URLs and client secrets.
- Certificates/TLS: Secure transport layer security, particularly for database connectors.
- RBAC (Role-Based Access Control): Integration with existing database permission models.
Sources: airbyte-integrations/developer-docs/destinations/preflight-checklist.md:21-25, docusaurus/platform_versioned_docs/version-2.1/connector-development/ux-handbook.md:162-165
Connection and Authentication Flow
The following diagram illustrates the high-level process of validating credentials and establishing a secure connection to a database destination.
The system must "fail fast and actionably," informing the user precisely how to fix invalid configurations.
Sources: airbyte-integrations/developer-docs/destinations/preflight-checklist.md:15-30, docusaurus/platform_versioned_docs/version-2.1/connector-development/ux-handbook.md:188-192
Data Security and Privacy
Airbyte distinguishes between different environment contexts (Cloud vs. Self-Managed) to ensure that sensitive configuration details are only shown where relevant.
Single-Sourcing and Content Masking
To prevent the accidental disclosure of environment-specific security procedures, documentation uses custom Markdown tags to hide or show content based on the user's platform.
| Tag | Function |
|---|---|
<HideInUI> | Prevents rendering content within the Airbyte application while keeping it on the public docs site. |
<!-- env:oss --> | Renders content only for Open Source (Self-Managed) builds. |
<!-- env:cloud --> | Renders content only for Airbyte Cloud builds. |
Sources: docusaurus/platform_versioned_docs/version-2.1/connector-development/writing-connector-docs.md:13-53
Secure Credential Handling
Developers are instructed to avoid exposing implementation details in configuration schemas. For example, if a configuration field requires an API key, the documentation must explain where to find it without requiring the user to understand the underlying code implementation.
{
"properties": {
"api_key": {
"type": "string",
"airbyte_secret": true,
"description": "The API key found in your dashboard under Settings > Security",
"title": "API Key"
}
}
}
Note: The airbyte_secret property (while not explicitly detailed in these files but implied by UX guidelines) ensures credentials are masked in the UI.
Sources: docusaurus/platform_versioned_docs/version-2.1/connector-development/ux-handbook.md:150-155, docusaurus/platform_versioned_docs/version-2.1/connector-development/ux-handbook.md:182-185
Permissions and Database Security
Implementing destination connectors requires specific knowledge of the target database's security model. This includes identifying required roles and privileges for operations like namespace creation and table management.
Security Checklist for Database Destinations
- Auth Support: Identify if the driver supports JDBC, native clients, or HTTP API authentication.
- Role/Privileges: Determine the minimum RBAC model (e.g.,
CREATE SCHEMApermissions). - Namespace Qualification: Understand if credentials allow access to specific schemas or entire databases.
- Error Classification: Classify database errors (e.g., SQL State 23505 for unique violations) to prevent leaking internal system states in error messages.
Sources: airbyte-integrations/developer-docs/destinations/preflight-checklist.md:15-45, airbyte-integrations/developer-docs/destinations/preflight-checklist.md:200-210
Permission Validation Sequence
The sequence below shows how a connector validates permissions before attempting data operations.
Security in Documentation and Contributions
The Airbyte project enforces a Code of Conduct for all contributors and utilizes automated linting tools to maintain the integrity of documentation related to security.
- Vale: Lints for prose, ensuring clear communication of security concepts and avoiding passive voice that might obscure responsibility.
- MarkDownLint: Ensures structural integrity of documentation to prevent rendering issues across different UI platforms (OSS vs. Cloud).
- CLA (Contributor License Agreement): Required for all contributors to ensure legal and security compliance for the codebase.
Sources: docusaurus/platform_versioned_docs/version-1.7/contributing-to-airbyte/writing-docs.md:180-185, docusaurus/platform_versioned_docs/version-1.7/contributing-to-airbyte/writing-docs.md:370-375
Conclusion
Security & Authentication in Airbyte are treated as non-negotiable infrastructure requirements. By leveraging strict input validation, environment-aware documentation, and comprehensive database preflight checks, the platform ensures that data integrity and credential safety remain intact throughout the replication lifecycle.