Skip to main content

LakeBase with Python Client

The Onehouse Python SDK provides a native Python client for LakeBase. It handles browser-based authentication flows (OIDC, Azure OAuth2, Azure Entra SAML) on top of a standard PostgreSQL connection — no Java or JDBC driver required.

Step 1: Install the SDK​

pip install onehouse-python-sdk[lakebase]

Requires Python 3.9 or later.

Step 2: Get Connection Details​

From the Onehouse console, open the Clusters page, click into your LakeBase cluster, and copy the Endpoint URL, username, and password. Refer to Get Connection Details for more.

If VPN is not enabled

If VPN is not enabled, configure a bastion host to reach the cluster. Refer to Connect to your VPC.

Step 3: Connect and Run a Query​

Choose the connection example that matches your cluster's authentication configuration.

Username / password​

Use this when your cluster authenticates with the username and password shown on the cluster connection details page (Onehouse Catalog or Glue Catalog without Lake Formation).

from onehouse_python_sdk import LakebaseClient

with LakebaseClient().connect(
    host="<cluster-host>",
    port=5432,
    dbname="postgres",
    user="<username>",
    password="<password>",
) as client:
    print(client.fetchone("SELECT 1"))

Azure AD OAuth2​

Use this when your cluster is configured with Azure AD OAuth2 (Authorization Code flow). A browser window opens for login on the first connection; credentials are cached for 4 minutes.

from onehouse_python_sdk import LakebaseClient

with LakebaseClient().connect(
    host="<cluster-host>",
    port=5432,
    dbname="postgres",
    browser_auth="true",
    azure_oauth_tenant_id="<tenant-id>",
    azure_oauth_client_id="<client-id>",
    azure_oauth_client_secret="<client-secret>",
    auth_callback_path="<callback-path>",  # must match the redirect URI registered in your Azure AD app (e.g. "/athena")
) as client:
    print(client.fetchone("SELECT 1"))

The SDK starts a local callback server at http://localhost:8888/<auth_callback_path>. This URL must exactly match a redirect URI registered in your Azure AD application. The default path is /lakebase — if your Azure AD app is registered with a different redirect URI, set auth_callback_path accordingly.

OIDC Device Flow (Okta / Auth0)​

Use this when your cluster is configured with an OIDC provider such as Okta or Auth0.

from onehouse_python_sdk import LakebaseClient

with LakebaseClient().connect(
    host="<cluster-host>",
    port=5432,
    dbname="postgres",
    browser_auth="true",
    oidc_client_id="<client-id>",
    oidc_issuer_url="https://<your-org>.okta.com",
    oidc_iam_role="arn:aws:iam::<account>:role/<onehouse-lakebase-role>",
) as client:
    print(client.fetchone("SELECT 1"))

Azure Entra ID SAML​

Use this when your cluster is configured with Azure Entra ID (formerly Azure AD) SAML.

from onehouse_python_sdk import LakebaseClient

with LakebaseClient().connect(
    host="<cluster-host>",
    port=5432,
    dbname="postgres",
    browser_auth="true",
    azure_tenant_id="<tenant-id>",
    azure_entity_id="<entity-id>",
) as client:
    print(client.fetchone("SELECT 1"))