How to change the OAuth token lifetime and the maximum number of OAuth tokens

[minhngc4795]

Hi team,

I’m working on generating an OAuth token using a service principal, following the instructions here: https://docs.databricks.com/en/dev-tools/auth/oauth-m2m.html#language-CLI, specifically the section on manually generating a workspace-level access token with the API (https://<databricks-instance>/oidc/v1/token).

However, I've encountered two issues:

1. I’m unable to customize the token expiration time. I’ve tried parameters like lifetime_seconds and expires_in, but they don’t seem to work. Could you clarify the correct parameter to use for setting a custom token lifetime?

2. If the token expiration is indeed fixed at 1 hour, what is the maximum number of OAuth tokens that can be generated within my workspace or account? (within 1 hour or 1 day)

Thanks in advance for your help!

[szymon_dybczak]

Hi @minhngc4795 ,

You can use below REST API endpoint to do that: 

https://docs.databricks.com/api/workspace/tokenmanagement/createobotoken

More info you can find at below article: 

https://kb.databricks.com/security/set-an-unlimited-lifetime-for-service-principal-access-token

[minhngc4795]

Thank you for your reply @szymon_dybczak 

However, I can't use those APIs with my current state. So I followed the website, and got only the Client ID (Application ID) and Client Secret for the Workspace level access.

Try to reproduce your link but not works for me. Non Authorization for Client ID + Client Secret 

[szymon_dybczak]

Hi, 

But why can't you use these APIs? To make it work your service principal needs to be added to your databricks workkspace and be added to admins group.There is no other way to change Oauth token liftetime than using this API

[minhngc4795]

Thank you for your reply @szymon_dybczak 

service principal added to admins group: This is the problem @szymon_dybczak, we don't want that service principal to get the admin privilege, it should have access to some tables/schemas in our workspace but not all of them.