> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Databricks service principal secret rotation

> Learn how to automatically rotate Databricks Service Principal OAuth Secrets.

Rotate the OAuth client secret of a Databricks service principal on a schedule.

> [!NOTE]
>
> **Rotation Type: Dual-Phase**
>
> This rotation maintains two active credential sets with overlapping validity, ensuring zero-downtime during rotation cycles.

> [!NOTE]
>
> This rotation needs a [Databricks app connection](https://infisical.com/docs/integrations/app-connections/databricks.md). This guide walks you through creating a project-scoped app connection.

## Prerequisites

* A [project with secrets configured](https://infisical.com/docs/documentation/platform/secrets-mgmt/quick-starts/deliver-first-secret.md)
* Network access from Infisical to your Databricks workspace, if network restrictions apply

> [!NOTE]
>
> This rotation doesn't support [Gateways](https://infisical.com/docs/documentation/platform/gateways/overview.md) yet. Leave the app connection's **Gateway** field as **Internet Gateway**: a rotation that uses a connection with a Gateway or Gateway pool fails.

## Step 1: Set up in Databricks

Create a service principal Infisical can use to reach the workspace and grant it permission to reset the secrets of every service principal you want to rotate.

### 1. Open workspace settings

In Databricks, open the dropdown in the top right and select **Settings**.

![Workspace Settings Page](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/workspace-settings.png)

### 2. Open service principals

Under **Identity & Access**, select **Manage** in the **Service Principals** section.

![Manage Service Principals](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/manage-service-principals.png)

### 3. Add a service principal

Select **Add Service Principal**, then **Add New**, and create a service principal for Infisical.

![Add Service Principal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/add-service-principal.png)

![Create Service Principal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/create-service-principal.png)

### 4. Generate a secret

Open the new service principal, select the **Secrets** tab, and select **Generate secret**. In the dialog:

1. Set **Lifetime (days)** to how long Infisical can use the secret (up to 730 days)
2. Under **Scope**, select **Other APIs**, then use **Add scope** to add `authentication` and `scim`
3. Select **Generate**, then save the **Client ID** and **Secret** for the Infisical form

![Generate Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/service-principal-secrets.png)

![Copy IDs](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/service-principal-ids.png)

> [!NOTE]
>
> You can't change a secret's scopes after you generate it. To use other scopes, or before the secret expires, generate a new secret and update the connection's **Client Secret** and **Scopes**.

### 5. Grant rotation permissions

The Infisical service principal needs to manage the secrets of every service principal whose secrets you want to rotate.

1. Navigate to **Settings > Identity & Access > Groups** and select the admin group (typically named `admins` or `workspace-admins`). Select **Add** and pick the Infisical service principal.

   ![Admin Group](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/admin-group.png)

   ![Add to Admin Group](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/add-to-admin-group.png)

   ![Add to Admin Group Modal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/add-to-admin-group-form.png)

2. For every service principal whose secrets you want to rotate, open **Settings > Identity & Access > Service Principals**, select the target, open its **Permissions** tab, and select **Grant access**.

   ![Select Target Service Principal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/select-target-service-principal.png)

   ![Permissions Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/permissions-tab.png)

3. In **User, Group or Service Principal**, select the Infisical service principal. In **Permission**, select **Manage**. Select **Save**. Repeat for every target.

   ![Assign Manage Permission](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/assign-manage-permission.png)

## Step 2: Set up the rotation in Infisical

> [!TIP]
>
> To create the rotation using the API, use the [Create Databricks Service Principal Secret Rotation](https://infisical.com/docs/api-reference/endpoints/secret-rotations/databricks-service-principal-secret/create.md) endpoint.

### 1. Add the rotation

In your Secrets Management project, open the dashboard and select **Add Secret Rotation** from the actions dropdown.

![Secrets Management Dashboard](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/generic/add-secret-rotation.png)

Then, select the **Databricks Service Principal** rotation:

![Select Databricks Service Principal Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/databricks-service-principal-secret/databricks-service-principal-secret-option.png)

### 2. Configure the app connection

Create or select the Databricks app connection the rotation will use.

> [tab] Create a new app connection
>
> Under **Databricks Connection**, select **Create Connection**, then choose **Databricks Connection**. Select the **Service Principal** method and complete the form:
>
> * **Name**: A descriptive name for the connection
> * **Description** (optional): A note for future reference
> * **Gateway**: The Gateway or Gateway pool to route requests through if your Databricks workspace isn't reachable from the internet; otherwise leave it as **Internet Gateway**
> * **Workspace URL**: The URL of your Databricks workspace
> * **Client ID**: The Client ID of the Databricks service principal created for Infisical
> * **Client Secret**: The [secret generated](#generate-a-secret) for that service principal
> * **Scopes** (optional): The scopes you [selected for that secret](#generate-a-secret) (leave empty if the secret has the `all-apis` scope or no scopes)
>
>   ![Connect via Databricks service principal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/databricks-service-principal-secret/configure-connection.png)
>
> Then, select **Connect to Databricks**.
>
> > [!NOTE]
> >
> > This creates a connection scoped to the current project. To share the connection across other projects, [create it at the organization level](https://infisical.com/docs/integrations/app-connections/databricks.md#step-2-create-the-app-connection) first, then select it here.

> [tab] Use an existing connection
>
> Under **Databricks Connection**, select the app connection you'd like to use.

### 3. Configure the rotation

Set the rotation behavior.

![Rotation Configuration](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/databricks-service-principal-secret/databricks-service-principal-secret-configuration.png)

* **Rotation Interval**: The interval, in days, that once elapsed triggers a rotation.
* **Rotate At**: The local time of day when rotation should occur once the interval has elapsed.
* **Auto-Rotation Enabled**: When enabled, secrets rotate automatically once the interval elapses. Disable to rotate manually or pause rotation.

When you're done, select **Next**.

### 4. Pick the target service principal

Select the Databricks service principal whose OAuth secret you want to rotate, then select **Next**.

![Rotation Parameters](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/databricks-service-principal-secret/databricks-service-principal-secret-parameters.png)

### 5. Map the rotated values to secret names

Specify the secret names that the client credentials should be mapped to, then select **Next**.

![Rotation Secrets Mapping](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/databricks-service-principal-secret/databricks-service-principal-secret-mapping.png)

* **Client ID**: The name of the secret the service principal Client ID is written to.
* **Client Secret**: The name of the secret the rotated OAuth Client Secret is written to.

### 6. Configure the details

Give the rotation a **Name** and an optional **Description**, then select **Next**. The name must be slug-friendly.

![Rotation Details](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/databricks-service-principal-secret/databricks-service-principal-secret-details.png)

### 7. Review and create

Review your configuration, then select **Create Secret Rotation**.

![Rotation Review](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/databricks-service-principal-secret/databricks-service-principal-secret-review.png)

![Rotation Created](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-rotations-v2/databricks-service-principal-secret/databricks-service-principal-secret-created.png)

> [!TIP]
>
> Your Databricks service principal credentials are now available through the mapped secrets. If auto-rotation is enabled, they rotate on your configured schedule.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.