Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

feat: Define portable authentication type schemas for cross-connector credential sharing

Open
  • Is something wrong?
#869 1 comment 1 reaction 1 assignee View on GitHub

Maintainers usually reply within 1 day

@aaronsteers is already working on this.

Since Dec 25, 2025.

Assessment

This issue has not been assessed yet.

Description

Summary

This issue tracks the work to define and implement portable authentication type schemas in the Python CDK that enable credential sharing across connectors (sources, destinations, and sonar integrations) that connect to the same API.

Requested by: AJ Steers (@aaronsteers)

Background

Analysis of 693+ connectors across Airbyte OSS, Enterprise, and Sonar integrations identified 10 distinct authentication mechanisms that can be consolidated into standardized JSON schemas. The goal is to make authentication configuration portable across connector types for the same API.

Objectives

  1. Define JSON schemas for all identified authentication types
  2. Build these schemas into the Python CDK
  3. Provide a migration path for legacy connectors with differently-named authentication fields
  4. Require connectors to declare transformation logic mapping legacy config to new schemas (for major version bump)

Proposed Authentication Type Schemas

Click to expand: Authentication Type Definitions
1. OAuth 2.0
oauth2:
  type: object
  title: "OAuth 2.0"
  required: [access_token]
  properties:
    access_token:
      type: string
      title: "Access Token"
      airbyte_secret: true
    refresh_token:
      type: string
      title: "Refresh Token"
      airbyte_secret: true
    client_id:
      type: string
      title: "Client ID"
      airbyte_secret: true
    client_secret:
      type: string
      title: "Client Secret"
      airbyte_secret: true
    token_expiry:
      type: string
      format: date-time
      title: "Token Expiry"
2. Personal Access Token (PAT)
personal_access_token:
  type: object
  title: "Personal Access Token"
  required: [token]
  properties:
    token:
      type: string
      title: "Personal Access Token"
      airbyte_secret: true
3. Basic Authentication
basic_auth:
  type: object
  title: "Basic Authentication"
  required: [username, password]
  properties:
    username:
      type: string
      title: "Username"
    password:
      type: string
      title: "Password"
      airbyte_secret: true
4. API Key
api_key:
  type: object
  title: "API Key"
  required: [key]
  properties:
    key:
      type: string
      title: "API Key"
      airbyte_secret: true
    header_name:
      type: string
      title: "Header Name"
      default: "Authorization"
    prefix:
      type: string
      title: "Prefix"
      default: ""
5. Bearer Token
bearer_token:
  type: object
  title: "Bearer Token"
  required: [token]
  properties:
    token:
      type: string
      title: "Bearer Token"
      airbyte_secret: true
6. Database Credentials
database_credentials:
  type: object
  title: "Database Credentials"
  required: [host, port, username, password]
  properties:
    host:
      type: string
      title: "Host"
    port:
      type: integer
      title: "Port"
    username:
      type: string
      title: "Username"
    password:
      type: string
      title: "Password"
      airbyte_secret: true
    database:
      type: string
      title: "Database"
    ssl_mode:
      type: string
      title: "SSL Mode"
      enum: [disable, require, verify-ca, verify-full]
7. Cloud Provider IAM
cloud_iam:
  type: object
  title: "Cloud Provider IAM"
  properties:
    provider:
      type: string
      enum: [aws, gcp, azure]
    # AWS
    aws_access_key_id:
      type: string
      airbyte_secret: true
    aws_secret_access_key:
      type: string
      airbyte_secret: true
    aws_role_arn:
      type: string
    # GCP
    gcp_service_account_json:
      type: string
      airbyte_secret: true
    # Azure
    azure_tenant_id:
      type: string
    azure_client_id:
      type: string
    azure_client_secret:
      type: string
      airbyte_secret: true
8. JWT (JSON Web Token)
jwt:
  type: object
  title: "JWT Authentication"
  required: [private_key]
  properties:
    private_key:
      type: string
      title: "Private Key"
      airbyte_secret: true
    issuer:
      type: string
      title: "Issuer"
    subject:
      type: string
      title: "Subject"
    audience:
      type: string
      title: "Audience"
9. Session Token
session_token:
  type: object
  title: "Session Token"
  properties:
    session_token:
      type: string
      title: "Session Token"
      airbyte_secret: true
    login_url:
      type: string
      title: "Login URL"
    username:
      type: string
    password:
      type: string
      airbyte_secret: true
10. No Authentication
no_auth:
  type: object
  title: "No Authentication"
  properties: {}

Implementation Plan

  1. Phase 1: Schema Definition

    • Define JSON schemas for all 10 authentication types
    • Create validation utilities for each schema
    • Add schema documentation

  2. Phase 2: CDK Integration

    • Add authentication schemas to CDK core
    • Create base authenticator classes that accept canonical schemas
    • Implement adapter pattern for schema transformation

  3. Phase 3: Migration Support

    • Define migration interface for legacy connectors
    • Create helper functions for common field mappings
    • Document migration requirements for major version bump

  4. Phase 4: Connector Updates

    • Update connectors to use new schemas (or declare adapters)
    • Validate backward compatibility
    • Release as major CDK version

Related Analysis

This issue is informed by comprehensive authentication analysis across:

  • 674 Airbyte OSS connectors
  • 9 Airbyte Enterprise connectors
  • 11 Sonar integrations

Key findings:

  • 6 OAuth implementation patterns identified (client credentials, static refresh, single-use refresh with write-back, bearer passthrough, JWT service account, multiple options)
  • 4 simplified categories: Identity-Based, Username/Password, Token/Key Handoff, No Auth
  • 8 of 10 sonar connectors have identical auth support to traditional counterparts
  • Field name normalization needed (e.g., Stripe: api_key vs client_secret)

Devin Session

Link to Devin run: https://app.devin.ai/sessions/bf1ea66ad90247afb3f7156ffb2f05a7

Dominant language
Python
Stars
27
Forks
56
Avg merge
1d 20h
Merged PRs (30d)
26

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from airbytehq/airbyte-python-cdk

All issues in airbytehq/airbyte-python-cdk

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.