Managing data access from development to deployment

Overview

When deploying code from Posit Workbench to Posit Connect, you typically need different credential types in each environment. This page explains how to write code that handles credentials correctly in both environments.

How credentials differ between environments

The credential type and scope you use between development and deployment will most often differ.

  • Development (Workbench): Typically a single, interactive user session. Developers use their own user-scoped credential.

  • Deployment (Connect): Many users or machines view or consume content, and consumers can share the same processing environment. Viewers should access data using either their own credentials or a shared service principal, not the developer credential.

Tip

While this page focuses on Workbench and Connect for development and deployment environments, the fundamental logic applies to local development environments and alternative deployment targets.

Environment-based credential patterns

Some data sources have packages with helper functions that help you use different credentials in Workbench and Connect, such as the Python posit-sdk package or the R connectcreds package. When a helper is available, the code examples in this documentation use it. For other data sources, you might need to add logic to your code that switches between credential types based on the environment, as described below.

To run your code on both Workbench and Connect, add logic that applies one credential pattern when deployed to Connect and falls back to a different pattern for Workbench. You can add a second fallback for local development. Connect and Workbench set specific environment variables automatically to support this:

  • All content running on Posit Connect has the environment variable POSIT_PRODUCT=CONNECT set.1
  • All sessions running on Posit Workbench have the environment variablePOSIT_PRODUCT=WORKBENCH set.2

The code examples below illustrate this concept of changing the access pattern depending on environment.

Alternating credentials between Connect and Workbench

import os

# if running on Connect
if os.getenv("POSIT_PRODUCT") == "CONNECT":
  print("Running on Posit Connect. Using Connect credential provider...")
  # insert access pattern for Connect (e.g., Viewer OAuth Credential)

# if running outside of Connect (in development)
else:
  print("Running in Posit Workbench. Using Workbench credential provider...")
  # insert access pattern for Workbench (e.g., Workbench Managed Credential)
# if running on Connect
if (Sys.getenv("POSIT_PRODUCT") == "CONNECT") {
  message("Running on Posit Connect. Using Connect credential provider...")
  # insert access pattern for Connect (e.g., Viewer OAuth Credential)

# if running outside of Connect (in development)
} else {
  message("Running in Posit Workbench. Using Workbench credential provider...")
  # insert access pattern for Workbench (e.g., Workbench Managed Credential)
}

Alternating credentials between Connect, Workbench, and a local development environment

import os

# if running on Connect
if os.getenv("POSIT_PRODUCT") == "CONNECT":
  print("Running on Posit Connect. Using Connect credential provider...")
  # insert access pattern for Connect (e.g., Viewer OAuth Credential)

# if running on Workbench
elif os.getenv("POSIT_PRODUCT") == "WORKBENCH":
  print("Running in Posit Workbench. Using Workbench credential provider...")
  # insert access pattern for Workbench (e.g., Workbench Managed Credential)

# if running in local development
else:
  print("Running in local development environment. Using local credentials...")
  # insert access pattern for local environment
# if running on Connect
if (Sys.getenv("POSIT_PRODUCT") == "CONNECT") {
  message("Running on Posit Connect. Using Connect credential provider...")
  # insert access pattern for Connect (e.g., Viewer OAuth Credential)

# if running on Workbench
} else if (Sys.getenv("POSIT_PRODUCT") == "WORKBENCH") {
  message("Running in Posit Workbench. Using Workbench credential provider...")
  # insert access pattern for Workbench (e.g., Workbench Managed Credential)

# if running in local development
} else {
  message("Running in local development environment. Using local credentials...")
  # insert access pattern for local development environment
}

Footnotes

  1. In Posit Connect versions prior to 2025.02, this environment variable was RSTUDIO_PRODUCT↩︎

  2. In Posit Workbench versions prior to 2026.01.0, check instead for the presence of any RSW_LAUNCHER | RS_SERVER_ADDRESS | RSTUDIO_MULTI_SESSION environment variables↩︎