Passwords written in PL/SQL code end up in source control, logs, and USER_SOURCE. A credential stores a user name and password in the database under a name, encrypted, so code refers to the name and never sees the password. DBMS_CREDENTIAL creates and manages credentials, and Scheduler jobs, DBMS_CLOUD, and UTL_HTTP can use them.
Code for This Guide
The main examples are in the examples/pkg-files-network folder of the Oracle Database 26ai code repository on GitHub, each with its output. They use NIMBUS, the sample schema of a fictional airline, which you can install with the scripts in the setup/nimbus folder.
They come from Oracle Database 26ai SQL and PL/SQL Book.
Syntax
dbms_credential.create_credential(credential_name, username, password,
comments => null);
dbms_credential.update_credential(credential_name, attribute, value);
dbms_credential.disable_credential(credential_name);
dbms_credential.enable_credential(credential_name);
dbms_credential.drop_credential(credential_name);Creating a credential needs the CREATE CREDENTIAL privilege. UPDATE_CREDENTIAL changes the username, password, or comments.
Create and Update a Credential
Example:
begin
dbms_credential.create_credential(
credential_name => 'OPS_REPORTS',
username => 'ops',
password => 'ops-demo',
comments => 'Daily report service');
end;
/
select credential_name, username, enabled, comments from user_credentials;
begin
dbms_credential.disable_credential('OPS_REPORTS');
dbms_credential.update_credential('OPS_REPORTS', 'username', 'ops_reader');
dbms_credential.enable_credential('OPS_REPORTS');
end;
/
select credential_name, username, enabled from user_credentials;Output:
PL/SQL procedure successfully completed. CREDENTIAL_NAME USERNAME ENABLED COMMENTS __________________ ___________ __________ _______________________ OPS_REPORTS ops TRUE Daily report service PL/SQL procedure successfully completed. CREDENTIAL_NAME USERNAME ENABLED __________________ _____________ __________ OPS_REPORTS ops_reader TRUE
USER_CREDENTIALS lists the credential with its user name and comment, and has no password column. The credential is disabled while its user name changes, then enabled again. The example drops it afterward.
Use a Credential in an HTTP Call
UTL_HTTP.SET_CREDENTIAL sends the user name and password of a credential for basic authentication. The call below goes to the local test server, setup/netlab/server.mjs in the repository, whose demo login is ops with password ops-demo.
Example:
-- once, at setup time: the test server's demo user and password
begin
dbms_credential.create_credential(credential_name => 'OPS_REPORTS',
username => 'ops', password => 'ops-demo');
end;
/
-- later, in application code: only the credential name
declare
v_req utl_http.req;
v_resp utl_http.resp;
v_text varchar2(4000);
begin
v_req := utl_http.begin_request('http://host.docker.internal:8099/reports/daily');
utl_http.set_credential(v_req, 'OPS_REPORTS');
v_resp := utl_http.get_response(v_req);
utl_http.read_text(v_resp, v_text);
utl_http.end_response(v_resp);
dbms_output.put_line(v_resp.status_code || ': ' || v_text);
end;
/Output:
PL/SQL procedure successfully completed.
200: {"date":"2026-03-15","flights":31,"on_time_pct":87.1}
PL/SQL procedure successfully completed.The protected report returns 200, and the code that calls it contains only the name OPS_REPORTS. The example drops the credential afterward.
Things to Know
- Create credentials in a setup script that is not kept in source control, or let a DBA create them.
- A disabled credential cannot be used, which is a quick way to block access without deleting it.
- Credentials belong to a schema; grant EXECUTE on a credential to let other users use it without reading it.
Related Guides
- How to Read HTTP Responses with UTL_HTTP.BEGIN_REQUEST
- How to Run AI Jobs in the Background with DBMS_SCHEDULER
Conclusion
DBMS_CREDENTIAL keeps user names and passwords in the database under a name, so code and jobs refer to the name instead of the password. Create credentials once, use them with UTL_HTTP, the Scheduler, and DBMS_CLOUD, and disable or drop them to cut off access.
