Manage Security for Confluent Cloud Schema Registry and Stream Catalog

Schema Registry and Stream Catalog on Confluent Cloud build on three security mechanisms: API keys, role-based access control (RBAC), and OAuth. This page describes how to secure each service and which credentials each one accepts.

Although both services share the same Schema Registry endpoint on Confluent Cloud, they don’t accept the same credentials. API keys and OAuth authenticate requests, and RBAC authorizes what the authenticated principal (user or service account) can do. Schema Registry accepts global API keys on private networking, whereas Stream Catalog does not.

The sections that follow describe each service separately, including its API keys, RBAC, and OAuth support.

Authentication at a glance

The following table shows how to authenticate to each service. Both services also accept RBAC for authorization, described in each service’s section below.

Mechanism

Schema Registry

Stream Catalog

Notes

Resource-scoped API key

Yes

Yes

Both services authenticate with the Schema Registry API key. Stream Catalog has no API key of its own and reuses the Schema Registry key.

Global API key

Yes

No

Schema Registry accepts a global API key on private networking only. Stream Catalog does not accept global API keys and requires the resource-scoped Schema Registry key instead.

OAuth

Yes

Yes

Schema Registry’s Java and Go clients accept OAuth. Stream Catalog accepts OAuth on its REST API.

Security for Schema Registry

Schema Registry stores and serves the schemas in a Confluent Cloud environment, and Confluent Cloud runs one Schema Registry per environment. Securing Schema Registry has two parts: authentication and authorization.

Authentication

Authenticate to Schema Registry with an API key or OAuth.

API keys for Schema Registry

To work with schemas on Confluent Cloud, you need an API key that grants access to Schema Registry. Confluent Cloud uses the key to authenticate you and to route requests to the correct logical cluster. Use either of the following API key types:

Schema Registry API key

A resource-scoped key specific to the Schema Registry cluster. This key is distinct from the API key you use to reach the Apache Kafka® clusters in the same Confluent Cloud environment.

Global API key

A global API key works in place of an Schema Registry-scoped key. When the same application also accesses Kafka, Apache Flink®, or other Confluent Cloud resources, a global API key lets you manage a single credential.

Note

A global API key authenticates to Schema Registry only on private networking. A public-networking Schema Registry cluster still requires a resource-scoped Schema Registry API key.

To create and manage these keys, see Create an API key for Confluent Cloud Schema Registry in Quick Start for Schema Management on Confluent Cloud. For background on managing access in Confluent Cloud, see Service Accounts on Confluent Cloud and User account types.

OAuth for Schema Registry clients

If you prefer short-lived tokens over a long-lived API key, the Schema Registry clients accept OAuth. The Schema Registry Java client implements the OpenID Connect (OIDC) protocol and OAuth 2.0, so it can present a token instead of a key. Use a standard OAuth bearer token with a public OIDC server, or pair a custom token provider with your own implementation. The Schema Registry Go client implements OAuth 2.0 as well.

Authorization

RBAC controls who can read and change the Schema Registry subjects and topics. Assign roles to a user account or service account to grant each principal only the access it needs. For the roles and the steps to assign them, see Access control (RBAC) for Confluent Cloud Schema Registry.

Security for Stream Catalog

Stream Catalog is the searchable inventory of the schemas, topics, and other data assets in a Confluent Cloud environment. Both its REST and GraphQL APIs use the same Schema Registry endpoint that serves schemas. Its security model resembles the one for Schema Registry, but the two are not identical. The sections below note the differences.

Authentication

Authenticate to Stream Catalog with an API key or OAuth.

API keys for Stream Catalog

Stream Catalog has no API key of its own. It shares the Schema Registry endpoint, so authenticate to Stream Catalog with the resource-scoped Schema Registry API key—the same credential you use for Schema Registry itself. You need an API key and secret for the Schema Registry cluster in the environment you want to work in. For details, see Create an API key for Confluent Cloud Schema Registry.

Important

Stream Catalog does not accept global API keys. A global API key authenticates to Schema Registry on private networking, but Stream Catalog does not accept it. Use the resource-scoped Schema Registry API key, or OAuth, for Stream Catalog.

OAuth for Stream Catalog

The Stream Catalog REST API accepts OAuth as an alternative to an API key. Instead of an API key and secret, pass an identity pool ID, the target Schema Registry cluster, and an OAuth bearer token. For the request format and a worked example, see OAuth for Confluent Cloud Stream Catalog REST API. For OAuth on Confluent Cloud in general, see Use OAuth/OIDC to Authenticate to Confluent Cloud.

The GraphQL API does not accept OAuth. Authenticate with the resource-scoped Schema Registry API key instead.

Authorization

Stream Catalog accepts RBAC too, but its roles govern catalog-specific actions: defining, applying, and reading tags and business metadata, and running catalog searches. Because the role-to-resource mapping differs from the Schema Registry mapping, review it before assigning roles. For the mapping and the management steps, see Access control (RBAC) for Stream Catalog.

Related content