DataStax Astra DB (Data API)

Overview

Use DataStax Astra DB credentials to make authenticated API calls through Alter Vault without exposing API keys in code.

Note

Astra has two APIs and they do not share an authentication header. Use this provider to query data (documents, vectors, collections) on a per-database host. To manage databases themselves, use DataStax Astra DevOps instead. The same application token works with both — only the header differs, so picking the wrong one returns HTTP 401 even though the token is valid.

Property	Value
Provider ID	astra
Category	Database
Credential Type	Application Token
API host	https://<db-id>-<region>.apps.astra.datastax.com (per database)

Step 1: Get Credentials

Log in to the Astra Portal

Log in to the Astra Portal.

Generate a token

Open the database’s Overview tab and click Generate Token.

Copy the token

Copy the application token (starts with AstraCS:) — it is only shown once.

Warning

Never share credentials publicly. Store them securely and only enter them in the Alter Vault Developer Portal.

Step 2: Add to Alter Vault

Open the Developer Portal

Go to portal.alterauth.com and navigate to the application.

Add DataStax Astra DB

Go to Managed Secrets > Add Provider > DataStax Astra DB.

Enter credentials

Paste your Application Token into the credential field.

Save

Click Save. You’ll receive a grant_id to use with the SDK.

Using in Code

response = await alter_app.request(
    HttpMethod.POST,
    "https://YOUR-DB-ID-REGION.apps.astra.datastax.com/api/json/v1/default_keyspace/my_collection",
    grant_id="YOUR_GRANT_ID",
    json={"find": {"filter": {}, "options": {"limit": 5}}},
)

Notes

• The token is injected via the Token header at the database’s Data API endpoint.
• Creating or listing databases uses a different provider and a different header — see DataStax Astra DevOps.

Policy-cataloged operations

Alter policy rules can target these attested operations and families for operation-level and parameter-aware controls.

Operation ID	Families	Method	Provider path
collection/deleteMany	admin, delete, read, write	POST	/api/json/v1/{keyspace}/{collection}
keyspace/dropCollection	admin, delete, read, write	POST	/api/json/v1/{keyspace}
database/findEmbeddingProviders	admin, delete, read, write	POST	/api/json/v1