This procedure describes how to rotate the three JWT-based credential types that Tetra issues: Service User JWT Tokens, Organization-Level SQL JWT Tokens, and Login User SQL JWT Tokens. Use it when TetraScience asks you to rotate credentials, or as part of your organization's routine credential hygiene.

⚠️

WARNING

Rotating any of these credentials immediately invalidates the previous credential. Each credential type supports only one active token or credential set at a time. Any Tetra File-Log Agent (FLA), Connector, Agent, API script, or third-party SQL client (JDBC/ODBC, Tableau, Snowflake, and so on) that's still configured with the old value fails to authenticate as soon as you generate the new one. Update every downstream consumer with the new credential before or immediately after you generate it, and rotate during a low-traffic window when possible.

Who Can Perform Each Rotation

Rotate Service User JWT Tokens

Service User tokens authenticate non-human integrations, such as Agents, Connectors, FLA, and custom API scripts. Plan the update to each downstream system in the same change window as the rotation.

1. Sign in to Tetra with an Administrator role.
2. Select Administration > Organization Settings, and then open the Service Users tab.
3. Locate the service user account associated with the integration that you're rotating (for example, the account used by a specific Agent, Connector, FLA instance, or API integration).
4. Use the row's menu to generate a new JWT for that service user. Copy the new token value immediately. After you close the dialog, the full token value can't be retrieved again.
5. If the service user's access is scoped through an Access Group, confirm that the service user is still included in the correct Access Group(s) so that it retains the data access it needs after rotation.
6. Update the Agents, Connectors, FLA configurations, or API scripts that used the old token with the new token value.
7. Verify that each integration authenticates successfully with the new token (check Agent or Connector status in Tetra, or confirm a successful API call).

📘

NOTE

Exact menu labels for generating a Service User token may vary slightly by Tetra version. If you don't see the expected option, contact your Customer Success representative or TetraScience Support before proceeding.

For Agent- and Connector-specific steps, see Rotate Service User Tokens Used by Agents and Connectors. For Data Apps, see Rotate Credentials Used by Data Apps.

Rotate Organization-Level SQL JWT Tokens

Organization-level SQL credentials are shared credentials that third-party tools (JDBC/ODBC clients, Tableau, Snowflake, and so on) use to query Tetra Data through Amazon Athena at the organization level.

⚠️

WARNING

Generating new organization-level SQL credentials immediately breaks all existing third-party SQL connections that use the old credentials. There is no grace period, and only one set of organization-level SQL credentials can be active at a time. Notify all teams and tools that rely on the shared organization-level credentials before you rotate.

1. Sign in to Tetra with an Administrator role.
2. Select Administration > Organization Settings, and then open the SQL Access tab.
3. In the SQL Credentials section, select Replace Credentials. (This option reads Create Credentials if no organization-level credentials exist yet.)
4. In the confirmation dialog, select Create new credentials. Tetra immediately issues a new Access Key, Secret Key, connection URL, and S3OutputLocation, and invalidates the previous set.
5. Copy the new Access Key, Secret Key, and connection URL.
6. Update your third-party SQL connections (JDBC/ODBC driver configuration, Tableau, Snowflake, or other BI or analytics tools) that used the previous organization-level credentials with the new values. Confirm that the WorkGroup connection parameter still matches your organization's slug.
7. Re-test each connection to confirm that queries succeed with the new credentials.

Rotate Login User SQL JWT Tokens

Login User (personal) SQL credentials authenticate an individual user's own SQL client connections to Tetra. Each login user rotates their own credentials.

1. Sign in to Tetra as the login user.
2. Select My Account and locate the SQL Credentials section.
3. Select Rotate Credentials. (This option reads Generate Credentials if you haven't created personal SQL credentials before.)
4. Copy the new Access Key and Secret Key shown in the confirmation dialog.
5. Update your JDBC/ODBC driver configuration or SQL client with the new Access Key and Secret Key. Confirm that the WorkGroup connection parameter matches your organization's slug.
6. Re-test the connection to confirm that queries succeed with the new credentials.

📘

NOTE

Only one set of personal SQL credentials can be active per login user at a time; rotating immediately invalidates the previous set. An Administrator can also remove a login user's SQL credentials entirely from the Organization Settings > Login Users tab (through that user's row menu) if the credentials should be revoked, for example, for an offboarded user.

General Notes

• These three credential types are distinct from a login user's Personal Token (My Account > Personal Token), which is used for personal API and SDK access. Personal Tokens follow the same "generate a new one, then discard the old one" pattern if they also need to be rotated.
• Because these credentials can be used to configure FLA, Connectors, Agents, and API integrations, coordinate with each system owner before rotating so that downstream jobs aren't interrupted.
• If you're unsure which service users, Agents, Connectors, or integrations use a given credential, check the relevant Access Group membership and each integration's configuration before rotating, rather than after.

Related Documentation

• Authentication
• Organization Settings
• Manage Your Account
• Admin SQL Access
• SQL Queries
• Tetra Scientific Data Cloud
• Rotate Credentials Used by Data Apps
• Rotate Service User Tokens Used by Agents and Connectors