The connector authenticates only with a personal access token — Login() in pkg/client/client.go posts personalAccessTokenName / personalAccessTokenSecret to /auth/signin, and there's no other credential path.
Two problems with that for a permanent integration. A PAT belongs to a person, so the integration inherits that account's lifecycle — role changes, offboarding, someone tidying up their own token list. And Tableau expires PATs by policy: 1–365 days depending on site settings, plus automatic revocation after 15 consecutive days unused. There is no configuration in which the credential doesn't eventually die.
Tableau Cloud has supported Connected Apps with Direct Trust for the REST API since October 2023. It's a site-level trust rather than a user's token — hold a client id and secret, mint a short-lived JWT per sign-in, pass it as credentials.jwt to /auth/signin. Rotation becomes a deliberate act against a site object instead of a surprise tied to whoever happened to create the token.
Would you take a PR adding it as an alternative credential set alongside the existing PAT fields?
The connector authenticates only with a personal access token —
Login()inpkg/client/client.gopostspersonalAccessTokenName/personalAccessTokenSecretto/auth/signin, and there's no other credential path.Two problems with that for a permanent integration. A PAT belongs to a person, so the integration inherits that account's lifecycle — role changes, offboarding, someone tidying up their own token list. And Tableau expires PATs by policy: 1–365 days depending on site settings, plus automatic revocation after 15 consecutive days unused. There is no configuration in which the credential doesn't eventually die.
Tableau Cloud has supported Connected Apps with Direct Trust for the REST API since October 2023. It's a site-level trust rather than a user's token — hold a client id and secret, mint a short-lived JWT per sign-in, pass it as
credentials.jwtto/auth/signin. Rotation becomes a deliberate act against a site object instead of a surprise tied to whoever happened to create the token.Would you take a PR adding it as an alternative credential set alongside the existing PAT fields?