How connectors work
Native vs. legacy connectors, auth models, and what "native" buys you.
A connector is a saved, configured connection to a data source or destination. Everything else in Databasin — pipelines, SQL, Databasin One — reads through connectors, so it's worth a couple of minutes to understand the two kinds and what each one gives you.
Two tiers
Connectors come in two tiers, and you'll see both in the same gallery when you click Add connection on the Connectors tab.
| Databasin Native | Category connectors | |
|---|---|---|
| What it is | 31 pre-built, certified connectors | The broader catalog of databases, files, and APIs |
| Setup | Guided, step-by-step | A standard connection form |
| Data routes | Certified — the useful endpoints are wired up for you | You point it at the tables or paths you need |
| Semantic layer | Most ship one (the ✨ badge) | Not included |
Databasin Native is the flagship tier. The category connectors — sometimes called the legacy tier — cover the long tail of databases (Postgres, MSSQL, Oracle…), file and object stores (S3, ADLS, SharePoint…), and APIs.
What "native" buys you
When a connector carries the ✨ badge, three things come for free:
- Guided setup. An in-product setup guide walks you through exactly where to get a token or key, so onboarding is minutes, not a support ticket.
- Certified data routes. The connector's endpoints are validated — pagination and incremental watermarks are already handled, so you don't have to reverse-engineer the vendor's API.
- A ready-made semantic layer. Most native connectors ship a curated model of the data. That's what lets Databasin One answer questions about a freshly connected source immediately, with no modeling on your part.
For the full, always-current list of native and category connectors, see the connector catalog.
Auth models
How you prove who you are depends on the source. The common models:
| Model | What it is |
|---|---|
| OAuth2 | Sign in with the vendor; Databasin stores and refreshes the token. |
| Custom Headers / API key | Paste a key; Databasin sends it as a request header. |
| API Token | A vendor-issued token paired with an account email — Jira and Confluence use this. |
| Basic | Username and password (some vendors use an API key as the username). |
| WS-Security | SOAP-style credentials, used by enterprise systems like Workday. |
| Personal Access Token | A long-lived token you generate in the vendor's UI (Databricks, Azure DevOps). |
| Azure Service Principal | An Entra ID app registration — no user password, and it rotates centrally. |
| Key pair | A private key instead of a password. Available on Snowflake. |
| Storage keys / SAS | Account keys or a scoped SAS token, for object stores. |
| None | Public APIs that need no authentication at all. |
The form adapts to whichever model the connector uses — you only ever see the fields that apply.
Both remove a human password from the loop, which means the connection doesn't break the next time someone rotates their credentials or leaves. Azure Service Principal is available on ADLS, Databricks, MSSQL, Synapse, Dynamics, Fabric, and Epic Clarity; key pair on Snowflake.
One exception to know about: a dbt automation task against Databricks needs a Personal Access Token — it can't use the service-principal path. See The task types.
Protocols
Most connectors speak REST. A handful use GraphQL (for example, Shopify) or SOAP (for example, Workday), and some native connectors are hybrids that combine more than one. You don't choose the protocol — the connector handles it under the hood.
System-managed connectors
The lakehouse query engines — Trino, Doris, Spark, and DuckDB — and their staging storage appear as system-managed connectors. Databasin provisions these automatically when it sets up your lakehouse, so there's no form to fill out. They're how the data your pipelines land becomes queryable in the SQL editor and in Databasin One.