Connect Databricks with service principal OAuth
Databricks data sources in GrowthBook can authenticate with OAuth machine-to-machine (M2M) using a service principal. You enter the service principal's Client ID and OAuth secret instead of a personal access token. Databricks recommends OAuth over personal access tokens for stronger security.
How authentication works
GrowthBook exchanges the service principal's Client ID and OAuth secret for short-lived access tokens at query time and refreshes them automatically. The connection doesn't need a long-lived personal access token.
- Personal access token (PAT) authentication remains supported, and existing Databricks connections keep using their token.
- If you switch an existing connection from a token to OAuth, GrowthBook asks for the new OAuth secret before you save.
Prepare the connection
Create or reuse a Databricks service principal and generate an OAuth secret for it. Grant the service principal permission to use your SQL Warehouse and access the data you want to query. Then have these values ready:
- The SQL Warehouse's server hostname, port, and HTTP path, from its Connection Details page in Databricks.
- The service principal's Client ID and OAuth secret. Databricks shows the secret only once, so copy it when you generate it.
Getting started
On the Data Sources page under Metrics and Data, add a data source and choose Databricks. Set Authentication method to OAuth (machine-to-machine), then enter the warehouse details, Client ID, and OAuth secret. The Databricks setup guide walks through each step, including service principal permissions.
