> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Databricks sync

> Learn how to configure a Databricks Sync for Infisical.

A Databricks Secret Sync pushes secrets from Infisical into a [Databricks secret scope](https://docs.databricks.com/en/security/secrets/secret-scopes.html) that jobs and notebooks in the workspace can read.

> [!NOTE]
>
> The Databricks Secret Sync requires a [Databricks app connection](https://infisical.com/docs/integrations/app-connections/databricks.md). This guide walks you through creating a project-scoped app connection.

## Prerequisites

* A [project with secrets configured](https://infisical.com/docs/documentation/platform/secrets-mgmt/quick-starts/deliver-first-secret.md)
* A Databricks secret scope you want secrets synced into. If you don't have one yet, [create a scope](https://docs.databricks.com/en/security/secrets/secret-scopes.html) in your workspace first.

## Step 1: Set up in Databricks

Create a service principal Infisical can use to reach the workspace.

### 1. Open workspace settings

In Databricks, open the dropdown in the top right and select **Settings**.

![Workspace Settings Page](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/workspace-settings.png)

### 2. Open service principals

Under **Identity & Access**, select **Manage** in the **Service Principals** section.

![Manage Service Principals](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/manage-service-principals.png)

### 3. Add a service principal

Select **Add Service Principal**, then **Add New**, and create a service principal for Infisical.

![Add Service Principal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/add-service-principal.png)

![Create Service Principal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/create-service-principal.png)

### 4. Generate a secret

Open the new service principal, select the **Secrets** tab, and select **Generate secret**. In the dialog:

1. Set **Lifetime (days)** to how long Infisical can use the secret (up to 730 days)
2. Under **Scope**, select **Other APIs**, then use **Add scope** to add the scopes for the features you plan to use:
   * `secrets` for secret syncs
   * `authentication` and `scim` for secret rotations
3. Select **Generate**, then save the **Client ID** and **Secret** for the Infisical form

![Generate Secret](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/service-principal-secrets.png)

![Copy IDs](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/app-connections/databricks/service-principal-ids.png)

> [!NOTE]
>
> You can't change a secret's scopes after you generate it. To use other scopes, or before the secret expires, generate a new secret and update the connection's **Client Secret** and **Scopes**.

## Step 2: Set up the sync in Infisical

> [!TIP]
>
> To create the sync using the API, use the [Create Databricks Sync](https://infisical.com/docs/api-reference/endpoints/secret-syncs/databricks/create.md) endpoint.

### 1. Add the sync

In your project, go to **Integrations** and open the **Secret Syncs** tab. Select **+ Add Sync**.

![Secret Syncs Tab](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/general/secret-sync-tab.png)

Then, select the **Databricks** sync.

![Select Databricks](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/databricks/select-databricks-option.png)

### 2. Configure the source

Configure the **Source** to specify which secrets to sync from Infisical.

![Configure Source](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/databricks/databricks-source.png)

* **Environment**: The project environment to retrieve secrets from.
* **Secret Path**: The folder path to retrieve secrets from.

> [!TIP]
>
> If you need to sync secrets from multiple folder locations, check out [secret imports](https://infisical.com/docs/documentation/platform/secret-reference.md#secret-imports).

Then select **Next** to configure the sync's destination.

### 3. Configure the app connection

Create or select the Databricks app connection the sync will use.

> [tab] Create a new app connection
>
> Under **Databricks Connection**, select **Create Connection** in the dropdown, then choose **Databricks Connection**. Select the **Service Principal** method, then fill in:
>
> * **Name**: A descriptive name for the connection
> * **Description** (optional): A note for future reference
> * **Gateway**: The Gateway or Gateway pool to route requests through if your Databricks workspace isn't reachable from the internet; otherwise leave it as **Internet Gateway**
> * **Workspace URL**: The URL of your Databricks workspace
> * **Client ID**: The Client ID of the Databricks service principal created for Infisical
> * **Client Secret**: The [secret generated](#generate-a-secret) for that service principal
> * **Scopes** (optional): The scopes you [selected for that secret](#generate-a-secret) (leave empty if the secret has the `all-apis` scope or no scopes)
>
>   ![Connect via Databricks service principal](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/databricks/configure-connection.png)
>
> Select **Connect to Databricks**. Infisical returns you to the sync form with the new connection selected.
>
> > [!NOTE]
> >
> > This creates a connection scoped to the current project. To share the connection across other projects, [create it at the organization level](https://infisical.com/docs/integrations/app-connections/databricks.md#step-2-create-the-app-connection) first, then select it here.

> [tab] Use an existing connection
>
> Under **Databricks Connection**, select the app connection you'd like to use.

### 4. Configure the target scope

Configure the Databricks secret scope where secrets should be deployed.

![Configure Destination](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/databricks/databricks-destination.png)

* **Scope**: The Databricks secret scope to sync secrets to.

> [!NOTE]
>
> Ensure your service principal has [Write permissions](https://docs.databricks.com/en/security/auth/access-control/index.html#secret-acls) for the specified secret scope. We recommend a designated scope for the sync so it doesn't remove secrets managed elsewhere.

When you're done, select **Next**.

### 5. Configure the sync options

Configure the **Sync Options** to specify how secrets should be synced.

![Configure Options](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/databricks/databricks-options.png)

* **Initial Sync Behavior**: How Infisical resolves the initial sync.
  * **Overwrite Destination Secrets**: Removes any secrets at the destination not present in Infisical.
  > [!NOTE]
  >
  > The Databricks Secret Sync doesn't support importing secrets.
* **Key Schema**: Template that transforms secret names when syncing. Use `{{secretKey}}` for the original secret name and `{{environment}}` for the environment.
  > [!NOTE]
  >
  > Use a **Key Schema** so Infisical only manages the keys that match the schema, leaving other keys untouched.
* **Auto-Sync Enabled**: When enabled, secrets sync automatically as the source changes. Disable to sync manually only.
* **Disable Secret Deletion**: When enabled, Infisical doesn't remove secrets from the destination. Enable this if you intend to manage some secrets manually outside of Infisical.

When you're done, select **Next**.

### 6. Configure the details

Give the sync a **Name** and an optional **Description**. The name must be slug-friendly.

![Configure Details](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/databricks/databricks-details.png)

Then select **Next**.

### 7. Review and create

Review your Databricks Sync configuration, then select **Create Sync**.

![Confirm Configuration](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/databricks/databricks-review.png)

![Sync Secrets](https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/secret-syncs/databricks/databricks-created.png)

> [!TIP]
>
> The sync is created. If auto-sync is enabled, it begins syncing secrets to the selected Databricks secret scope right away.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.