Connect DBeaver with PyBritive
Overview
DBeaver can run a shell command before it connects to a database. You can use that hook to run a pybritive checkout first, so DBeaver always connects with fresh, just-in-time credentials — no copying secrets by hand.
What you’ll learn:
- Write a pre-connect shell script that checks out a profile with PyBritive
- Wire it into a DBeaver connection
- Connect with ephemeral credentials
Before You Begin
- PyBritive installed and authenticated
- DBeaver installed
- A Britive profile whose checkout returns database credentials, with a
pybritiveprofile alias mapped to it
pybritive is usually not on the PATH that DBeaver uses for shell commands. Use the full path to the binary, and to any other non-shell commands.
Create the Pre-Connect Script
Keep the logic in a standalone script rather than the DBeaver command box — it’s easier to maintain.
Write the script
#!/bin/bash
# $1 = connection name, mapped to a pybritive profile alias
/Users/yourname/.pyenv/shims/pybritive checkout "$1" -t demo -s \
| sed -n '2p' | tr -d '\n' | pbcopyThis checks out the profile named by $1, takes the credential line, and copies it to the clipboard. Adjust the pybritive path, tenant (-t), and output handling for your environment.
Make it executable
chmod +x /Users/yourname/dbeaver.shWire It Into DBeaver
Open connection settings
Edit an existing connection and go to Connection Settings → Shell Commands → Before Connect.
Call the script
/Users/yourname/dbeaver.sh "${datasource}"${datasource} is a DBeaver variable holding the connection name — it maps to your pybritive profile alias.
Verify
Open the connection in DBeaver. The pre-connect command runs pybritive checkout first, and DBeaver connects using the just-in-time credentials.
# run the script manually to confirm it checks out and copies a credential
/Users/yourname/dbeaver.sh my-connectionA future version could decrypt and update DBeaver’s credentials-config.json directly instead of using the clipboard. That path is experimental and not covered here.