Pangolin acts as a standard Apache Iceberg REST Catalog, making it compatible with the Python-native PyIceberg library.
Choose the guide that matches your environment:
For multi-tenant environments where security is enforced via JWT tokens.
- Credential Vending (Recommended): Pangolin manages storage keys.
- Client-Provided Credentials: You provide storage keys to the client.
For automation and CI/CD where persistent access is needed.
- API Key Authentication: Using Service User API keys.
For rapid local testing and development.
- Credential Vending: Test the vending flow without RBAC.
- Client-Provided Credentials: Basic local storage connectivity.
Detailed configuration for different storage backends.
- Azure & GCP Integration: Connecting to ADLS Gen2 and Google Cloud Storage.
To enable Credential Vending, PyIceberg must send the X-Iceberg-Access-Delegation header with the value vended-credentials. This tells Pangolin that the client expects temporary storage keys for its operations.
While Pangolin extracts tenant context from the authentication token, we strongly recommend explicitly setting the header.X-Pangolin-Tenant property in your PyIceberg configuration. This ensures reliable routing for all operations, especially during initial connection.