# Source configuration

> Name data sources, supply vendor credentials, and control credential resolution

`config.sources` names each source to run and tells Data Serve which vendor
credential to use.

## Source identifiers

```text
<provider>__<source>
```

Both parts are lowercase, spaces become underscores, and the separator is two
underscores. Provider punctuation remains. `IP-Api` and `Geolocation` become
`ip-api__geolocation`.

Unknown identifiers return HTTP `200` with `Adapter not found for <identifier>`
in `status`; other sources continue.

> **Confirmation needed:** Confirm whether available source identifiers are
> public or account-specific. A public list needs a separate maintained page.

## Configuration values

| Value | Meaning |
| --- | --- |
| `true` | Run without a request-supplied credential |
| `{}` | Same as `true` |
| `{ "credentials": { ... } }` | Use the supplied credential |

```json
{
  "sources": {
    "ip-api__geolocation": true,
    "dsmock__person_alpha": {},
    "vendor__product": {
      "credentials": { "cred_id": "crd_01k9j3bfxjedvvtq3jx43y8q8d" }
    }
  }
}
```

Keys other than `credentials` inside a source object are ignored by `/data`.

## Credentials

### Stored credential

```json
{
  "sources": {
    "vendor__product": {
      "credentials": { "cred_id": "crd_01k9j3bfxjedvvtq3jx43y8q8d" }
    }
  }
}
```

This is the recommended method.

### Credential fields

```json
{
  "sources": {
    "vendor__product": {
      "credentials": {
        "username": "<username>",
        "password": "<password>"
      }
    }
  }
}
```

The fields depend on the source. Sending them puts vendor secrets in the body.

### No credential

If none is supplied, Data Serve uses the organization's default stored
credential for that source.

## Resolution order

1. Fields in `config.sources.<source>.credentials`.
2. The stored credential named by `cred_id`.
3. The organization default for the source.

`/data` does not auto-select credentials. `/func` can when the workflow enables
it. See [Run a data function](/docs/api/data-serve/func-run/).

## Credential validation

Resolved credentials are filtered to declared source fields and validated
against the source credential schema. A missing required field fails only that
source.

> **Confirmation needed:** Confirm the exact public wording of the
> missing-credential status message before clients rely on the example text.

## Security

Body credentials apply only to that request and are not stored. Production
transaction redaction removes them under the default production level. Prefer
`cred_id` so the secret does not leave Datastruct's boundary.