# Manage Security for Confluent Cloud Schema Registry and Stream Catalog Schema Registry and Stream Catalog on Confluent Cloud build on three security mechanisms: API keys, role-based access control (RBAC), and OAuth. This page describes how to secure each service and which credentials each one accepts. Although both services share the same Schema Registry endpoint on Confluent Cloud, they don’t accept the same credentials. API keys and OAuth authenticate requests, and RBAC authorizes what the authenticated principal (user or service account) can do. Schema Registry accepts [global API keys](../security/authenticate/workload-identities/service-accounts/api-keys/overview.md#cloud-global-api-keys) on private networking, whereas Stream Catalog does not. The sections that follow describe each service separately, including its API keys, RBAC, and OAuth support. ## Authentication at a glance The following table shows how to authenticate to each service. Both services also accept RBAC for authorization, described in each service’s section below. | Mechanism | Schema Registry | Stream Catalog | Notes | |-------------------------|-------------------|------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Resource-scoped API key | Yes | Yes | Both services authenticate with the Schema Registry API key. Stream Catalog has no API
key of its own and reuses the Schema Registry key. | | Global API key | Yes | No | Schema Registry accepts a global API key on private networking only. Stream Catalog
does not accept global API keys and requires the resource-scoped Schema Registry
key instead. | | OAuth | Yes | Yes | Schema Registry’s Java and Go clients accept OAuth. Stream Catalog accepts OAuth on
its REST API. | ## Security for Schema Registry Schema Registry stores and serves the schemas in a Confluent Cloud environment, and Confluent Cloud runs one Schema Registry per environment. Securing Schema Registry has two parts: authentication and authorization. ### Authentication Authenticate to Schema Registry with an API key or OAuth. #### API keys for Schema Registry To work with schemas on Confluent Cloud, you need an API key that grants access to Schema Registry. Confluent Cloud uses the key to authenticate you and to route requests to the correct logical cluster. Use either of the following API key types: Schema Registry API key : A resource-scoped key specific to the Schema Registry cluster. This key is distinct from the API key you use to reach the Apache Kafka® clusters in the same Confluent Cloud environment. Global API key : A [global API key](../security/authenticate/workload-identities/service-accounts/api-keys/overview.md#cloud-global-api-keys) works in place of an Schema Registry-scoped key. When the same application also accesses Kafka, Apache Flink®, or other Confluent Cloud resources, a global API key lets you manage a single credential.
#### NOTE A global API key authenticates to Schema Registry only on private networking. A public-networking Schema Registry cluster still requires a resource-scoped Schema Registry API key. To create and manage these keys, see [Create an API key for Confluent Cloud Schema Registry](../get-started/schema-registry.md#ccloud-sr-manage-api-keys-per-env) in [Quick Start for Schema Management on Confluent Cloud](../get-started/schema-registry.md#cloud-sr-config). For background on managing access in Confluent Cloud, see [Service Accounts on Confluent Cloud](../security/authenticate/workload-identities/service-accounts/overview.md#service-accounts) and [User account types](../security/authenticate/user-identities/user-accounts/overview.md#user-accounts). #### OAuth for Schema Registry clients If you prefer short-lived tokens over a long-lived API key, the Schema Registry clients accept OAuth. The Schema Registry Java client implements the OpenID Connect (OIDC) protocol and OAuth 2.0, so it can present a token instead of a key. Use a standard OAuth bearer token with a public OIDC server, or pair a custom token provider with your own implementation. The Schema Registry Go client implements OAuth 2.0 as well. - To configure the Java client, see [Configure Schema Registry Java clients](../security/authenticate/workload-identities/identity-providers/oauth/clients/java-clients.md#configure-sr-java-clients-for-oauth). - To configure the Go client, see [Configure Schema Registry Go clients](../security/authenticate/workload-identities/identity-providers/oauth/clients/go-clients.md#configure-sr-go-clients-for-oauth). ### Authorization RBAC controls who can read and change the Schema Registry subjects and topics. Assign roles to a user account or service account to grant each principal only the access it needs. For the roles and the steps to assign them, see [Access control (RBAC) for Confluent Cloud Schema Registry](schemas-manage.md#cloud-sr-rbac). ## Security for Stream Catalog Stream Catalog is the searchable inventory of the schemas, topics, and other data assets in a Confluent Cloud environment. Both its [REST](../stream-governance/stream-catalog-rest-apis.md#stream-catalog-rest-apis) and [GraphQL](../stream-governance/graphql.md#catalog-graphql) APIs use the same Schema Registry endpoint that serves schemas. Its security model resembles the one for Schema Registry, but the two are not identical. The sections below note the differences. ### Authentication Authenticate to Stream Catalog with an API key or OAuth. #### API keys for Stream Catalog Stream Catalog has no API key of its own. It shares the Schema Registry endpoint, so authenticate to Stream Catalog with the resource-scoped Schema Registry API key—the same credential you use for Schema Registry itself. You need an API key and secret for the Schema Registry cluster in the environment you want to work in. For details, see [Create an API key for Confluent Cloud Schema Registry](../get-started/schema-registry.md#ccloud-sr-manage-api-keys-per-env). #### IMPORTANT Stream Catalog does not accept global API keys. A global API key authenticates to Schema Registry on private networking, but Stream Catalog does not accept it. Use the resource-scoped Schema Registry API key, or OAuth, for Stream Catalog. #### OAuth for Stream Catalog The Stream Catalog REST API accepts OAuth as an alternative to an API key. Instead of an API key and secret, pass an identity pool ID, the target Schema Registry cluster, and an OAuth bearer token. For the request format and a worked example, see [OAuth for Confluent Cloud Stream Catalog REST API](../stream-governance/stream-catalog-rest-apis.md#dg-tags-api-oauth). For OAuth on Confluent Cloud in general, see [Use OAuth/OIDC to Authenticate to Confluent Cloud](../security/authenticate/workload-identities/identity-providers/oauth/overview.md#oauth-overview). The GraphQL API does not accept OAuth. Authenticate with the resource-scoped Schema Registry API key instead. ### Authorization Stream Catalog accepts RBAC too, but its roles govern catalog-specific actions: defining, applying, and reading tags and business metadata, and running catalog searches. Because the role-to-resource mapping differs from the Schema Registry mapping, review it before assigning roles. For the mapping and the management steps, see [Access control (RBAC) for Stream Catalog](../stream-governance/stream-catalog.md#stream-catalog-rbac). ## Related content - [Create an API key for Confluent Cloud Schema Registry](../get-started/schema-registry.md#ccloud-sr-manage-api-keys-per-env) - [Access control (RBAC) for Confluent Cloud Schema Registry](schemas-manage.md#cloud-sr-rbac) - [Access control (RBAC) for Stream Catalog](../stream-governance/stream-catalog.md#stream-catalog-rbac) - [Stream Catalog REST API Usage and Examples on Confluent Cloud](../stream-governance/stream-catalog-rest-apis.md#stream-catalog-rest-apis) - [Global API keys](../security/authenticate/workload-identities/service-accounts/api-keys/overview.md#cloud-global-api-keys)