topic Re: OAuth API for service user in Administration & Architecture

OAuth API for service user

andreapeterson — Wed, 21 May 2025 18:26:15 GMT

Is there a way to programmatically create an OAuth secret for for a workspace service principal via API/SDK? As of now, the only way I can see doing this is through UI

Re: OAuth API for service user

Shua42 — Wed, 21 May 2025 22:06:20 GMT

Hi @andreapeterson ,

Currently, there isn't support for creating OAuth secrets through the API, only through the UI in the admin console. You can create 'on behalf of' tokens through the API for service principals, but not an OAuth secret at the moment: https://docs.databricks.com/api/workspace/tokenmanagement/createobotoken

Re: OAuth API for service user

andreapeterson — Thu, 22 May 2025 16:12:53 GMT

Hi Shua,
Thanks for responding. What is the difference between a token and OAuth? I only see OAuth in UI.
Also, is adding OAuth secrets for a service principal via api on the road map for Databricks?

Re: OAuth API for service user

vr — Fri, 23 May 2025 00:38:11 GMT

@andreapeterson isn't it the API you are looking for?
https://docs.databricks.com/api/azure/account/serviceprincipalsecrets/create

It is an account-level API, but, counterintuitively, when we create service principals in the workspace, they propagate into account behind the scene! If you create an account-level SP right away, it will not be added into any workspace, but can be added later using workspace-level create method. It is pretty confusing, because when we do that in the UI, these details are hidden from us. At least this is how it works in my Azure environment. It took me a while to realize that.

To summarize, in your case you need to try to create OAuth secret using the account-level API I gave, even though you created it in the workspace. Hopefully you have permissions to call account API in your org.

Re: OAuth API for service user

andreapeterson — Thu, 29 May 2025 13:41:35 GMT

This was exactly it! I do have permissions to call account api's in my org, however I did not realize I could call that api to make oauth secrets for other various workspace principals, so thank you so much for helping me and finding this and explaining that, it is confusing the propagation behind the scenes but I think I am finally getting the hang of it haha. Thank you again this was a great find