Authenticated Data Sources

Introduction

Passing a URL as data works when a file is public. But most real data is private — a SQL database, or a Google Sheet each user owns. The canvasxpress-connectors package (pip install canvasxpress-connectors) authenticates on the server, reshapes query results into a CanvasXpress data object, and serves it from your own origin. The browser only ever talks to your endpoint, so it never holds a credential.

How It Works

Every source returns rows; the package reshapes them into the CanvasXpress {y, x} object, which your endpoint returns as JSON and the browser hands to new CanvasXpress(...).

Browser (CanvasXpress)  -->  your app (this package)  -->  authenticated source
   no secrets                 auth + encrypted creds        database / Google Sheets

Databases (SQL)

SqlSource runs a read-only query against any database SQLAlchemy speaks (Postgres, MySQL, SQLite, …). Swapping databases is only a change of connection URL.

# Server side  ·  pip install "canvasxpress-connectors[sql]"
from cx_connectors.sources import SqlSource
from cx_connectors.sources.base import to_cx

data = to_cx(SqlSource(
    "postgresql+psycopg://user:pw@host/db",
    'SELECT sample, geneA, geneB, category FROM expression'))
# -> {"y": {"vars": [...], "smps": [...], "data": [...]}, "x": {...}}

<!-- Browser: chart the JSON your endpoint returned -->
fetch("/api/data")
  .then(function (r) { return r.json(); })
  .then(function (data) { new CanvasXpress("canvasId", data, { graphType: "Bar" }); });

Google Sheets

For private, per-user sheets, each user connects their own Google account once (OAuth). The package stores the encrypted refresh token, reads the sheet with the Sheets API, and returns a CanvasXpress object — the same shape as every other source.

# pip install "canvasxpress-connectors[sheets,web]"
from cx_connectors.web import create_sheets_app
app = create_sheets_app()   # OAuth login, token store, and /api/sheet-data

Ready-to-run Apps

Beyond the building blocks, the package ships mountable FastAPI apps you can drop into your own service:

• create_sheets_app() — per-user Google Sheets (OAuth), fully isolated.
• create_byo_app() — multi-tenant “bring your own database”: each user logs in, registers their own connection (stored encrypted), and charts only their data.

Connection strings and tokens are encrypted at rest; passwords are hashed; SQL sources are restricted to a single read-only SELECT.

Install & Resources

pip install canvasxpress-connectors            # core (reshape only)
pip install "canvasxpress-connectors[sql]"     # + SQL databases
pip install "canvasxpress-connectors[sheets]"  # + Google Sheets
pip install "canvasxpress-connectors[all]"     # everything incl. the web apps

Source, documentation, and runnable examples (SQLite, Postgres, Google Sheets, multi-tenant) are on GitHub and PyPI.