Skip to content
DuckDB Extensions All extensions VGI

OAuth & identity functions in the VGI DuckDB extension

Function category

OAuth & identity

3 functions

Inspect and manage the OAuth identity a catalog authenticates with: who you are, the tokens currently held, and signing out.

vgi_oauth_identity

Table function OAuth & identity
Signature
vgi_oauth_identity() → None
Returns

A table with the following columns:

Column catalog_name Type VARCHAR Description Catalog the identity applies to.
Column origin Type VARCHAR Description Origin (issuer host) that authenticated the identity.
Column authenticated Type BOOLEAN Description Whether an authenticated identity is currently established for the catalog.
Column sub Type VARCHAR Description Subject claim — the stable user identifier from the identity token.
Column email Type VARCHAR Description Email claim, if present in the token.
Column name Type VARCHAR Description Display-name claim, if present in the token.
Column issuer Type VARCHAR Description Token issuer (iss claim).
Column claims Type JSON Description Full set of identity claims, as JSON.
Description

Report the OIDC identity for each attached VGI catalog (catalog_name, origin, authenticated, sub, email, name, issuer, and the full decoded id_token claims as JSON). Reach provider-specific fields via the claims JSON, e.g. claims->>'$.hd' for Google Workspace.

1 Example 1 
SELECT * FROM vgi_oauth_identity();

vgi_oauth_logout

Table function OAuth & identity
Signature
vgi_oauth_logout(varargs: VARCHAR) → None
Arguments (Positional)
Argument varargs Type VARCHAR Mode Positional Description Varargs
Returns

A table with the following columns:

Column catalog_name Type VARCHAR Description Catalog whose stored tokens were cleared.
Column status Type VARCHAR Description Result of the logout for that catalog.
Description

Forget cached OAuth tokens. With no arguments, clears every stored token; pass one or more OAuth origins to clear only those. Returns one row per cleared origin.

1 Example 1 
SELECT * FROM vgi_oauth_logout();
2 Example 2 
SELECT * FROM vgi_oauth_logout('https://auth.example.com');

vgi_oauth_tokens

Table function OAuth & identity
Signature
vgi_oauth_tokens() → None
Returns

A table with the following columns:

Column catalog_name Type VARCHAR Description Catalog the token belongs to.
Column origin Type VARCHAR Description Origin (issuer host) the token was obtained from.
Column status Type VARCHAR Description Token status, e.g. valid or expired.
Column expires_in Type INTERVAL Description Time remaining until the access token expires.
Column has_refresh_token Type BOOLEAN Description Whether a refresh token is held for silent renewal.
Description

Show the OAuth tokens the extension has cached, one row per origin, with each token's expiry and refresh state. Token values themselves are never exposed. Pair with vgi_oauth_logout() to clear stale or unwanted tokens.

1 Example 1 
SELECT * FROM vgi_oauth_tokens();